I have Splunk version: 7.3.1 and I see the message: APPSERVER_PORT_ZERO
The value for: "appServerPorts" is set to 0, I get this message. I have tried with many different combinations like:
I have attached a screenshot of the error message. Any inputs would be appreciated.
The cited error message says the messages.conf file (not web.conf) is incorrect. If you have modified that file, undo your changes. If you have not modified that file, restore the original $SPLUNK_HOME/etc/system/default/messages.conf from backup or the original distribution.
@richgalloway Thank you for the suggestion. I had not made any changes to the file, however I tried to replace the file "messages.conf" from other installs the error remains. Can you please share a screenshot of the "[APPSERVER:APPSERVER_PORT_ZERO]" in the messages.conf file to see if it misses some content.
Here is the stanza in my messages.conf file (Splunk 8.0.6).
I reinstalled the entire system and now I'm getting the below error I described in the original post:
"Appserver: Running Splunk Web in legacy mode by setting appServerPorts=0 has been deprecated."
Any thoughts would be helpful.
What version of Splunk are you using?
The value of appServerPorts in etc/system/default/web.conf should be correct and allow Splunk to start.
Use btool to see if the value is being set by another app.
splunk btool --debug web list | grep appServerPorts
Splunk version is: 7.3.1
The result of the above command is:
/usr/local/share/voxeo/splunk/etc/system/local/web.conf appServerPorts = 0
No other app is making changes to it. Not sure where else to look.
There must be a line in /usr/local/share/voxeo/splunk/etc/system/default/web.conf that also sets that attribute to 8065. It's absence probably is what is keeping Splunk from starting.
You say you recently re-installed Splunk so I'm surprised this setting is missing and it makes me wonder what else is missing. Did you re-download the installer when you re-installed Splunk?
Do you have another instance of the same version from which you can copy web.conf?
There is a line in default/web.conf that has the value appServerPorts=8065, I still get the error
I had a copy of the Splunk installer on the system and used the same one. I need to check if I have another server with the same version.
I can try that and let you know the results.
Splunk version is 7.3.1