[root@n]# ./splunk status splunkd is running (PID: 6024). splunk helpers are running (PIDs: 6025). splunkweb is not running. I am curious that the check http port will not run while start splunk. [root@pptp-cent6 bin]# ./splunk start splunkd 6024 was not running. Stopping splunk helpers... [ OK ] Done. Stopped helpers. Removing stale pid file... done. Splunk> Finding your faults, just like mom. Checking prerequisites... Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Validated databases: _thefishbucket Done Success Checking conf files for typos... All preliminary checks passed. Starting splunk server daemon (splunkd)... [ OK ] Bellow is the web_service log information: root:133 - ENGINE: Caught signal SIGTERM. 2012-05-29 14:38:24,379 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus STOPPING 2012-05-29 14:38:24,635 INFO [4fc46e648196381ac] root:133 - ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('0.0.0.0', 8000)) shut down 2012-05-29 14:38:24,649 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread 'Monitor'. 2012-05-29 14:38:24,681 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread 'Monitor'. 2012-05-29 14:38:24,687 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread '_TimeoutMonitor'. 2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus STOPPED 2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus EXITING 2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus EXITED 2012-05-29 14:38:24,689 INFO [4fc46e648196381ac] root:133 - ENGINE: Waiting for child threads to terminate... Can someone tell me how to troubleshoot? ... View more

Hi, I added Splunk_CiscoSecuritySuite 1.0.1 today. There is an error on the top of the Cisco SecuritySuite web: "Error in 'lookup' command: The lookup table 'geoip' does not exist." "Unable to find an eventtype ironport*" How to resolve? Thanks ... View more