I'm having the following issue getting (splunkweb) to start running. In the web_service.log file it gives the following error below. This is from a fresh install of v6.1 on a FreeBSD box.
2014-05-27 09:36:58,327 INFO [538494f9e78045de150] init:161 - Using default logging config file: /opt/splunk/etc/log.cfg
2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk level=INFO
2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver level=INFO
2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers level=INFO
2014-05-27 09:36:58,328 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.controllers.proxy level=INFO
2014-05-27 09:36:58,329 INFO [538494f9e78045de150] init:199 - Setting logger=splunk.appserver.lib level=WARN
2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:729 - Unable to start splunkweb
2014-05-27 09:36:58,554 ERROR [538494f9e78045de150] root:730 - [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules'
Traceback (most recent call last):
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 110, in
from controllers.top import *
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/top.py", line 13, in
from admin import AdminController
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py", line 17, in
from splunk.appserver.mrsparkle.controllers.appinstall import AppInstallController
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/appinstall.py", line 9, in
from splunk.appserver.mrsparkle.lib import cached, module
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 460, in
moduleMapper = ModuleMapper()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 79, in init
self.installedModules = self.getInstalledModules()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 24, in helper
return f(*a, **kw)
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 443, in getInstalledModules
mods = self.getModuleList(root)
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 33, in helper
return f(*a, **kw)
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/module.py", line 211, in getModuleList
for (app_name, module_name, module_path) in local_apps.getAllModules():
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 195, in getAllModules
self.refresh(False)
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 121, in refresh
'modules' : self._scanSystemModules()
File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/apps.py", line 150, in _scanSystemModules
for module_dir in os.listdir(self.system_modules_path):
OSError: [Errno 2] No such file or directory: '/opt/splunk/share/splunk/search_mrsparkle/modules'
Guess what???? Did Splunk (The Corporation) name the directory as modules.new instead of modules? Gezzz....
root@:/opt/splunk/share/splunk # cd search_mrsparkle/
root@:/opt/splunk/share/splunk/search_mrsparkle # ls -l
total 12
drwxr-xr-x 12 root wheel 512 May 26 19:46 exposed
drwxr-xr-x 16 root wheel 512 May 26 19:46 modules.new
drwxr-xr-x 37 root wheel 1024 May 26 19:46 templates
A simple fix and I'm now up and running:
root@:/opt/splunk/share/splunk/search_mrsparkle # cp -r modules.new/ modules
root@:/opt/splunk/share/splunk/search_mrsparkle # /opt/splunk/bin/splunk start
Splunk> Now with more code!
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done
Starting splunkweb... Done
If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://DOMAIN_NAME:8000
Guess what???? Did Splunk (The Corporation) name the directory as modules.new instead of modules? Gezzz....
root@:/opt/splunk/share/splunk # cd search_mrsparkle/
root@:/opt/splunk/share/splunk/search_mrsparkle # ls -l
total 12
drwxr-xr-x 12 root wheel 512 May 26 19:46 exposed
drwxr-xr-x 16 root wheel 512 May 26 19:46 modules.new
drwxr-xr-x 37 root wheel 1024 May 26 19:46 templates
A simple fix and I'm now up and running:
root@:/opt/splunk/share/splunk/search_mrsparkle # cp -r modules.new/ modules
root@:/opt/splunk/share/splunk/search_mrsparkle # /opt/splunk/bin/splunk start
Splunk> Now with more code!
Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
All preliminary checks passed.
Starting splunk server daemon (splunkd)...
Done
Starting splunkweb... Done
If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com
The Splunk web interface is at http://DOMAIN_NAME:8000