Splunk Search

APPSERVER_PORT_ZERO - Warning Message

mtaher
Loves-to-Learn

I have Splunk version: 7.3.1 and I see the message: APPSERVER_PORT_ZERO

The value for: "appServerPorts" is set to 0, I get this message. I have tried with many different combinations like: 

  • "appServerPorts = 0", I get an warning message
  • If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
  • If I comment them out in both places, I get a warning about "appServerPorts = 0".
  • If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start

I have attached a screenshot of the error message. Any inputs would be appreciated.

Splunk_appserverports.JPG

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The cited error message says the messages.conf file (not web.conf) is incorrect.  If you have modified that file, undo your changes.  If you have not modified that file, restore the original $SPLUNK_HOME/etc/system/default/messages.conf from backup or the original distribution.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mtaher
Loves-to-Learn

@richgalloway Thank you for the suggestion. I had not made any changes to the file, however I tried to replace the file "messages.conf" from other installs the error remains. Can you please share a screenshot of the "[APPSERVER:APPSERVER_PORT_ZERO]" in the messages.conf file to see if it misses some content.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here is the stanza in my messages.conf file (Splunk 8.0.6).

richgalloway_0-1602521954380.png

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

mtaher
Loves-to-Learn

I reinstalled the entire system and now I'm getting the below error I described in the original post:

"Appserver: Running Splunk Web in legacy mode by setting appServerPorts=0 has been deprecated."

  • If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
  • If I comment them out in both places, I get a warning about "appServerPorts = 0".
  • If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start2020-10-12 appserver=0 error message for Splunk admin.png

Any thoughts would be helpful.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What version of Splunk are you using?

The value of appServerPorts in etc/system/default/web.conf should be correct and allow Splunk to start.

Use btool to see if the value is being set by another app.

splunk btool --debug web list | grep appServerPorts
---
If this reply helps you, Karma would be appreciated.
0 Karma

mtaher
Loves-to-Learn

Splunk version is: 7.3.1

The result of the above command is: 

/usr/local/share/voxeo/splunk/etc/system/local/web.conf                       appServerPorts = 0

No other app is making changes to it. Not sure where else to look.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There must be a line in /usr/local/share/voxeo/splunk/etc/system/default/web.conf that also sets that attribute to 8065.  It's absence probably is what is keeping Splunk from starting.

You say you recently re-installed Splunk so I'm surprised this setting is missing and it makes me wonder what else is missing.  Did you re-download the installer when you re-installed Splunk?

Do you have another instance of the same version from which you can copy web.conf?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mtaher
Loves-to-Learn

There is a line in default/web.conf that has the value appServerPorts=8065, I still get the error

I had a copy of the Splunk installer on the system and used the same one. I need to check if I have another server with the same version.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
The setting in default/web.conf is as it should be and Splunk should run with that setting.
Have you considered using a different version of Splunk?
---
If this reply helps you, Karma would be appreciated.
0 Karma

mtaher
Loves-to-Learn

I can try that and let you know the results.

0 Karma

mtaher
Loves-to-Learn

Splunk version is 7.3.1

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...