Security

Hosed my install -- can't get Splunkweb to start

morjo619
New Member

Hello All,

First off let me start by mentioning that I'm a Linux newb, so please forgive me if I come off as inexperienced. Anyway, I managed to get Splunk 4.2 installed on a Cent 5.6 server. I've been trying to get some test Windows servers to forward their eventlogs to the Splunk server via Snare. Which I was able too. I then read about using the Splunk Light Forwarder. I wasn't sure if I needed to do this but enabled SplunkLiteForwarder within the Splunk Server. It then prompted me to restart the web server, which I did. Since doing so I can't get the webserver back online. I keep issuing these commands to no avail:
[root@oc-mon01 bin]# ./splunk start splunkweb
[root@oc-mon01 bin]# ./splunk restart splunkweb
splunkweb is not running.

What should I should I do to the webserver back online?

Thanks,
J

Tags (1)
0 Karma
1 Solution

ziegfried
Influencer

You never should enable the SplunkLightForwarder app on a Splunk Server. This app is enabled on a forwarder instance where you want to minimize resource consumption. To fix this, go to $SPLUNK_HOME/etc/apps/SplunkLightForwarder/local and delete the app.conf file. And then restart Splunk.

View solution in original post

skmoorthy
New Member

Thanks dear. it is working now

0 Karma

ziegfried
Influencer

You never should enable the SplunkLightForwarder app on a Splunk Server. This app is enabled on a forwarder instance where you want to minimize resource consumption. To fix this, go to $SPLUNK_HOME/etc/apps/SplunkLightForwarder/local and delete the app.conf file. And then restart Splunk.

ziegfried
Influencer

The best place to get started, is the distributed deployment manual in the documentation: http://www.splunk.com/base/Documentation/latest/Deploy/Distributedoverview
http://www.splunk.com/base/Splexicon:Forwarder

0 Karma

morjo619
New Member

Sweet sauce!! You got me back. Ok, could you provide me some basic steps for me to do on using SplunkLightForwarder for my Windows boxes? I'm sorry, but I'm still learning what a forwarder instance means.

Thanks

0 Karma

morjo619
New Member

I'll give it a go and report back. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...