APPSERVER_PORT_ZERO - Warning Message

[mtaher]

I have Splunk version: 7.3.1 and I see the message: APPSERVER_PORT_ZERO

The value for: "appServerPorts" is set to 0, I get this message. I have tried with many different combinations like: 

• "appServerPorts = 0", I get an warning message
• If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
• If I comment them out in both places, I get a warning about "appServerPorts = 0".
• If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start

I have attached a screenshot of the error message. Any inputs would be appreciated.

[richgalloway]

The cited error message says the messages.conf file (not web.conf) is incorrect.  If you have modified that file, undo your changes.  If you have not modified that file, restore the original $SPLUNK_HOME/etc/system/default/messages.conf from backup or the original distribution.

[mtaher]

@richgalloway Thank you for the suggestion. I had not made any changes to the file, however I tried to replace the file "messages.conf" from other installs the error remains. Can you please share a screenshot of the "[APPSERVER:APPSERVER_PORT_ZERO]" in the messages.conf file to see if it misses some content.

[richgalloway]

Here is the stanza in my messages.conf file (Splunk 8.0.6).

[mtaher]

I reinstalled the entire system and now I'm getting the below error I described in the original post:

"Appserver: Running Splunk Web in legacy mode by setting appServerPorts=0 has been deprecated."

• If I comment out that line in local/web.conf, then the values in default/web.conf is used, and splunkweb does not start
• If I comment them out in both places, I get a warning about "appServerPorts = 0".
• If I set "appServerPorts = 8065" or some other unused value, splunkweb did not start

Any thoughts would be helpful.

[richgalloway]

What version of Splunk are you using?

The value of appServerPorts in etc/system/default/web.conf should be correct and allow Splunk to start.

Use btool to see if the value is being set by another app.

splunk btool --debug web list | grep appServerPorts

[mtaher]

Splunk version is: 7.3.1

The result of the above command is: 

/usr/local/share/voxeo/splunk/etc/system/local/web.conf                       appServerPorts = 0

No other app is making changes to it. Not sure where else to look.

[richgalloway]

There must be a line in /usr/local/share/voxeo/splunk/etc/system/default/web.conf that also sets that attribute to 8065.  It's absence probably is what is keeping Splunk from starting.

You say you recently re-installed Splunk so I'm surprised this setting is missing and it makes me wonder what else is missing.  Did you re-download the installer when you re-installed Splunk?

Do you have another instance of the same version from which you can copy web.conf?

[mtaher]

There is a line in default/web.conf that has the value appServerPorts=8065, I still get the error

I had a copy of the Splunk installer on the system and used the same one. I need to check if I have another server with the same version.

[richgalloway]

The setting in default/web.conf is as it should be and Splunk should run with that setting.
Have you considered using a different version of Splunk?

[mtaher]

I can try that and let you know the results.

[mtaher]

Splunk version is 7.3.1