Security

Winsock error 10061 while opening Splunk web

siva_cg
Path Finder

Hi Team,

I am trying to install Splunk Enterprise 7.1.1 on my local windows 10 machine and on board some of the security data for analysis. I have installed it as documented but unable to open the Splunk web and facing below error while opening.

This XML file does not appear to have any style information associated with it. The document tree is shown below.

Error connecting: Winsock error 10061

I have checked the documents and Splunk community for any solution but didn't find any relevant answers. Hope you could help to resolve the issue. Thanks in advance.

Few extracts from the Splunkd.log and web_service.log

06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" Traceback (most recent call last):
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py", line 66, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from splunk_instrumentation.input import run_input # noqa: E402
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\input.py", line 13, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from schedule_manager import ScheduleManager
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\schedule_manager.py", line 4, in
06-10-2018 23:00:02.535 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" from splunk_instrumentation.packager import Packager
06-10-2018 23:00:02.536 +0530 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\instrumentation.py"" File "C:\Program Files\Splunk\etc\apps\splunk_instrumentation\bin\splunk_instrumentation\packager_init_.py", line 3, in

2018-06-10 22:30:54,345 ERROR [5b1d5943d72239cf6a080] root:825 - Unable to start splunkweb
2018-06-10 22:30:54,346 ERROR [5b1d5943d72239cf6a080] root:826 - invalid syntax (enum.py, line 265)
Traceback (most recent call last):
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\root.py", line 102, in
from controllers.top import *
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\appserver\mrsparkle\controllers\top.py", line 30, in
from proxy import ProxyController

dchoi_splunk
Splunk Employee
Splunk Employee

If the Splunkd Service is running but unable to start web service in Windows or Linux

  1. Check if the web-port configured is open and listening on the instance(sometimes another process is bound to the port)
  2. Check if any firewall rule has been enabled to block
  3. Check if Certificates and SSL is working as expected then try to restart with disabled WebSSL under web.conf to isolate the issue [settings] enableSplunkWebSSL = false
  4. Check if any AV(Antivirus) product is running on the server. https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/RunningSplunkalongsideWindowsantivi...
  • When you run Splunk (Enterprise or forwarder) on a host that has an anti-virus product (such as McAfee VirusScan on Windows or Trend Micro ServerProtect on Linux) installed, Splunk strongly recommends that you exclude all Splunk processes as well as the Splunk installation directory from any kind of on-access scanning.

Splunkd is running but once you try to restart the web service via CLI, you might come across below response:

C:\Program Files\Splunk\bin>splunk restart splunkweb
502 Couldn't complete HTTP request: Winsock error #10061
Or
A server is busy message on HttpListener channel in splunkd log

Hope it helps.

0 Karma

nhvardhan58
Explorer

I am facing the same error, i do not have python Installed on the server. What would be the solution.

Can anybody help to resolve the issue.

0 Karma

nhvardhan58
Explorer

Can anybody help by letting us know how did this issue get resolved.

0 Karma

nhvardhan58
Explorer

Hi All,

I am facing the same error, i do not have python Installed on the server. What would be the solution.

0 Karma

Azeemering
Builder

Can you check if the Splunkd Service is running? (Search and type services.msc)

Winsock error 10061:
Connection refused.
No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host—that is, one with no server application running.

So either it loos like the service is not running or you have some sort of permission issue on your Windows10 install.

0 Karma

siva_cg
Path Finder

Hi @Azeemering,

Thank you for your response. Splunk service is running. I have installed Splunk as local user with admin privileges.

0 Karma

Azeemering
Builder

Do you have a local install of python by any chance?
Make sure there is no locally installed Python presented to Splunk as a default (environment variables etc.).

0 Karma

siva_cg
Path Finder

Hi @Azeemering,

Yes, I have Python installed on my local machine and environment variable specified. What will be solution in this case? Do I need to remove Python variable? Thanks in advance.

0 Karma

Azeemering
Builder

You need to uninstall python I guess...the versions are conflicting eachother and causing this issue.
Or you could try and play around with the Variables.
Splunk comes packaged with Python version 2.7

0 Karma

siva_cg
Path Finder

Thank you. I will try to play with variables first and if not succeeded, I will uninstall Python. Thank you very much once again.

0 Karma

RAVIKR
New Member

HOw did you resolve this issue?

0 Karma

nhvardhan58
Explorer

I am facing the same error, i do not have python Installed on the server. What would be the solution.

Can anybody help to resolve the issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...