Security

Waiting for web server at https:// (Web Services takes a long time to load)

hartfoml
Motivator

when I do a ./splunk restart it seems to stop and start normally accept that the web server seems to take a long time to load.

the ............... while waiting for web server takes more that one line to complete and the web server is almost always up before the splunk startup script knows it is up.

What can I check to see why Splunk web is taking so long to respond to the start command?

0 Karma

ashutoshab
Communicator

I think this is not an issue to be worried of, I faced the same scenario a few times. If you are on a Linux Machine try doing a tail -f /opt/splunk/var/log/splunk/splunkd.log while you perform ./splunk restart to restart the Splunk daemon. In some way, splunkd tries to access https://www.splunk.com/ or tries to resolve the name.

The issue you are facing will be seen, If the Machine where Splunk Is installed does not have connectivity to public internet i.e. Splunk web cannot resolve/connect to splunk.com. So it keeps trying to resolve the name but fails and Finally after a huge waiting Splunk Web starts. You can test this by Providing Connectivity to the instance, Splunk web will come up within a few seconds, once you disable the connectivity the problem will reappear.

So this is not an issue to be worried, it's just the lack of connectivity Splunk is trying to. it tries to resolve and fails.

0 Karma

lguinn2
Legend

Check the ownership/permissions on all the files under your Splunk home directory. If necessary, reset the file ownership. I had a similar problem once - and resetting the file ownership fixed it. (I had carelessly edited a configuration file and changed its ownership.) Of course, your problem could be completely different.

ben_leung
Builder

There must be an underlying issue. I am facing the same problem, made sure the permissions of the splunk directory were default (root user installation). Would it make a difference if the environment is SHC?

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...