Splunk not starting with 8089

[project9433]

Recently I had installed splunk 6.5.1 in a new box and I wanted to configure that as Indexer instance. So that later I can include it in an Indexer cluster. Now after accepting license, splunk is not getting started. It says the management 8089 is used and do you want to change the port . I thoroughly checked with the Linux team and myself the port is not used-up, but still the Splunk is not able to start with the port 8089.

One strange observation was, immediately after I accept splunk and start it, then I get 8089 port issues pop-up. Now the very next moment, I did netstat the 8089 was shown as used up by my Deployment server. After 5 sec I did again the netstat the port was shown as unused. Though I have no setting for Depl server in my new Indexer box.

It is like stomping, the splunk tries to start using 8089 and then says it is used up(none other than splunk) and then after few min I dont see the port used anymore (splunk releases the port)

[hardikJsheth]

Did you make any change to any of the configurations files in Splunk before starting??

[ryanhast · Accepted solution]

Make sure that your server is not also running a Splunk forwarder.
1. Uninstall then reinstall Splunk.

[project9433]

Yes, I did realize after reading this post that there was a splunkforwarder running in the box. After I stopped it, I was able to run splunk with 8089 port. The strange thing was, the netstat did not show the port usage by forwarder. Anyways, Thanks you Ryan you rock!

[10306629]

yes i have reinstall splunk but still the Splunk is not able to start with the port 8089