SplunkWeb Issues

[markes1]

I am running Ubuntu 10.04 on an i386 machine.

I get this output:

steve@steve-laptop:/opt/splunk/bin$ sudo ./splunk start [sudo] password for steve: splunkd 5067 was not running. Stopping splunk helpers...

Done. Stopped helpers. Removing stale pid file... done.

Splunk> 4TW

Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary All preliminary checks passed.

Starting splunk server daemon (splunkd)... Done. Starting splunkweb... Error starting splunkweb. steve@steve-laptop:/opt/splunk/bin$

I have checked web.conf, and that is set. I checked permissions, and they seem to be set too.

Any ideas or thoughts on what I should check next?

Take care.

Steve

[mw]

What happens if you run: splunk restart splunkweb

Also, anything obvious in $SPLUNK_HOME/var/log/splunk/web_service.log ?

[mw]

Which modules directory? I would expect Errno 2 on shutdown of splunkweb if it never started correctly. Is splunk running as a non-root user, by chance?

[markes1]

So, I renamed the "Modules" directory from "Modules.new" as I have residual files from an old Splunk installation on my machine.

SplunkWeb is still acting up, and the web_service.log is showing the following snippet of interest:

2010-12-01 11:05:55,955 WARNING [4cf6726329a3242cc] custompidfile:36 - Removing pidfile at /opt/splunk/var/run/splunk/splunkweb.pid (PID: 1796)"
2010-12-01 11:05:55,955 ERROR [4cf6726329a3242cc] custompidfile:42 - Unable to remove /opt/splunk/var/run/splunk/splunkweb.pid. [[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/splunkweb.pid']

Any ideas?