Splunk web is not working and port 8000 is having "CLOSE_WAIT" status?

[muradgh]

Hi Splunkers,

I'm trying to get the Splunk interface up but with no luck.

When I restart Splunk, it is getting stuck in the last step:
Waiting for web server at https://127.0.0.1:8000 to be available...................................

I then noticed that when I run the following command:

netstat -an | grep 8000

The output is:

tcp 13 0 0.0.0.0:8000 0.0.0.0:* LISTEN
tcp 518 0 10.242.13.20:8000 10.201.184.6:63670 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63648 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63717 CLOSE_WAIT
tcp 155 0 127.0.0.1:8000 127.0.0.1:51036 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63743 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63742 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:64055 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63669 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63649 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63730 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63718 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63731 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:64056 CLOSE_WAIT

After some troubleshooting I have tried to set the "connection_host" in the inputs.conf to "none" but with no luck.

Then I tried to increase default values for the web threadpool in the web.conf but with no luck also.

I even tried to restart the server itself but with no luck.

Any thoughts that can help me?

[shivanshu1593]

Under $SPLUNK_HOME/etc/system/local/web.conf, maybe try using a different port which is free and restart Splunkd.

[settings]
httpport = <new_port>

[muradgh · Accepted solution]

After some troubleshooting, I found out that there was an issue with the web certificate.

Solved it and everything worked normally.

Many thanks for your advice.