Splunk Enterprise

Splunk web is not working and port 8000 is having "CLOSE_WAIT" status?

muradgh
Path Finder

Hi Splunkers,

I'm trying to get the Splunk interface up but with no luck.

When I restart Splunk, it is getting stuck in the last step:
Waiting for web server at https://127.0.0.1:8000 to be available...................................

I then noticed that when I run the following command:

netstat -an | grep 8000

The output is:

tcp 13 0 0.0.0.0:8000 0.0.0.0:* LISTEN
tcp 518 0 10.242.13.20:8000 10.201.184.6:63670 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63648 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63717 CLOSE_WAIT
tcp 155 0 127.0.0.1:8000 127.0.0.1:51036 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63743 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63742 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:64055 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63669 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63649 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63730 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63718 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:63731 CLOSE_WAIT
tcp 518 0 10.242.13.20:8000 10.201.184.6:64056 CLOSE_WAIT

 

After some troubleshooting I have tried to set the "connection_host" in the inputs.conf to "none" but with no luck.

Then I tried to increase default values for the web threadpool in the web.conf but with no luck also.

I even tried to restart the server itself but with no luck.

 

Any thoughts that can help me?

Labels (2)
Tags (2)
0 Karma
1 Solution

muradgh
Path Finder

After some troubleshooting, I found out that there was an issue with the web certificate.

Solved it and everything worked normally.

Many thanks for your advice. 

View solution in original post

0 Karma

shivanshu1593
Builder

Under $SPLUNK_HOME/etc/system/local/web.conf, maybe try using a different port which is free and restart Splunkd.

[settings]
httpport = <new_port>

 

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###

muradgh
Path Finder

After some troubleshooting, I found out that there was an issue with the web certificate.

Solved it and everything worked normally.

Many thanks for your advice. 

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...