we are having the following issue while trying to start splunk (version 6.2) .
/opt/splunk/bin/splunk start Splunk> Now with more code! Checking prerequisites... Checking http port : open Checking mgmt port : open Checking appserver port [127.0.0.1:8065]: already bound ERROR: The appserver port [127.0.0.1:8065] is already bound. Splunk needs to use this port. Would you like to change ports? [y/n]: y Enter a new appserver port: 8066 Setting appserver port: 8066 The port specified is in use. Please enter a different port. Enter a new appserver port: 8067 Port "8067" is invalid, please enter a number between 1 and 65535 Enter a new appserver port:
The appserver port already bound.. We don't have anything on this system except Splunk. I also tried to check what process was using this port, but i didn't get any response. Also tried to set another port 8066 or 8067 but not possible. We also tried version 6.2.1 same issue.
The issue started after we did a reboot of the system
Any clue on this.
I am also seeing this same issue and the only way I was able to get around it was by setting the port to 0 in web.conf. netstat showed port 8086 not in use, and I couldn't use any other port. Were you able to figure out why you were seeing this?
Can we see what the output of the following commands is after stopping splunk or making sure that splunk processes are not running with ps etcetera:
netstat -an | grep 8065
lsof |grep 8065