Security

splunkweb arbitrary crashing

aphextwin
New Member

Hi Folks
Been scratching my head on this....any help is appreciated!

Issue:
splunkweb crashes for unknown reason at random times. usually happens when a new login session is initiated

Some background:
Splunk version -4.3 build 115073
OS: Mac OS 10.6 Server
Setup: Windows heavy-forwarder sending to MacOSX indexer. HTTP running only on indexer.

web_service.log:
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:321 - require_login - no splunkd sessionKey variable set; cherrypy_session=1562893fce4233c5947f6dd9cf1b53c434f8f279 request_path=/en-US/
2012-03-15 11:53:21,934 INFO [4f6167b1ee72e1c70] decorators:328 - require_login - redirecting to login
2012-03-15 11:53:28,617 INFO [4f6167b88a2aafb90] account:209 - user=XXXXXXXX action=login status=success session=9966eadb5d6bd2051ea9a8f6bc63c160 reason=user-initiated useragent="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; MS-RTC LM 8; InfoPath.2; .NET4.0E; Zune 4.7)" clientip=10.176.5.193
2012-03-15 11:53:28,648 INFO [4f6167b8a57a431f0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,779 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,780 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,781 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,782 WARNING [4f6167b8a57a431f0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,793 INFO [4f6167b8ca2aafdd0] cached:77 - memoized decorator used on function with non hashable arguments
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,885 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_detail_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_user_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "search_ui_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "index_status_health" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,886 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "indexing_volume" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkd_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "splunkweb_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "inputs_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,887 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_user_app" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_savedsearch" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "scheduler_status_errors" is referenced in the navigation definition for "search".
2012-03-15 11:53:28,888 WARNING [4f6167b8ca2aafdd0] view:356 - An unknown view name "pdf_activity" is referenced in the navigation definition for "search".
2012-03-15 11:53:29,034 INFO [4f6167b8ca2aafdd0] view:1056 - PERF - viewTime=0.0981s templateTime=0.143s
2012-03-15 11:53:29,187 ERROR [4f4a50173e17af970] root:133 - ENGINE: Error in HTTP server: shutting down
Traceback (most recent call last):
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/process/servers.py", line 73, in start_http_thread
self.httpserver.start()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/
init.py", line 1692, in start
self.tick()
File "/Applications/splunk/lib/python2.7/site-packages/cherrypy/wsgiserver/
init.py", line 1745, in tick
s, addr = self.socket.accept()
File "/Applications/splunk/lib/python2.7/ssl.py", line 347, in accept
suppress_ragged_eofs=self.suppress_ragged_eofs),
File "/Applications/splunk/lib/python2.7/ssl.py", line 121, in __init
_
socket.getpeername(self)
File "/Applications/splunk/lib/python2.7/socket.py", line 224, in meth
return getattr(self._sock,name)(*args)
error: [Errno 22] Invalid argument

Tags (2)
0 Karma

melting
Splunk Employee
Splunk Employee

Looks like CherryPy is having trouble when sockets are closed unexpectedly. Thanks for letting us know. If you continue to have this problem I would suggest filing a case with support.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...