FYI - I ran into the same issue on one of my two heavy forwarders. the issue why the port 8000 was not accepting turned out to be an app that i had installed on the heavy forwarder. when i removed the app ( custom app ) the web port was accessible. upon investigating the app i noticed it had index.conf and i suspect that could have caused the issue, since that app was ment for indexer server, i deleted it from the Heavy forwarder and restarted splunk instance. the web GUI access then started working
... View more