Security

splunkweb is not running

coldface
Engager

[root@n]# ./splunk status
splunkd is running (PID: 6024).
splunk helpers are running (PIDs: 6025).
splunkweb is not running.

I am curious that the check http port will not run while start splunk.
[root@pptp-cent6 bin]# ./splunk start
splunkd 6024 was not running.
Stopping splunk helpers...
[ OK ]
Done.
Stopped helpers.
Removing stale pid file... done.

Splunk> Finding your faults, just like mom.

Checking prerequisites...
Checking mgmt port [8089]: open
Checking configuration... Done.
Checking index directory...
Validated databases: _thefishbucket
Done
Success
Checking conf files for typos...
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
[ OK ]

Bellow is the web_service log information:
root:133 - ENGINE: Caught signal SIGTERM.
2012-05-29 14:38:24,379 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus STOPPING
2012-05-29 14:38:24,635 INFO [4fc46e648196381ac] root:133 - ENGINE: HTTP Server cherrypy._cpwsgi_server.CPWSGIServer(('0.0.0.0', 8000)) shut down
2012-05-29 14:38:24,649 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread 'Monitor'.
2012-05-29 14:38:24,681 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread 'Monitor'.
2012-05-29 14:38:24,687 INFO [4fc46e648196381ac] root:133 - ENGINE: Stopped thread '_TimeoutMonitor'.
2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus STOPPED
2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus EXITING
2012-05-29 14:38:24,688 INFO [4fc46e648196381ac] root:133 - ENGINE: Bus EXITED
2012-05-29 14:38:24,689 INFO [4fc46e648196381ac] root:133 - ENGINE: Waiting for child threads to terminate...

Can someone tell me how to troubleshoot?

Tags (1)
0 Karma

Drainy
Champion

Because thats what a light forwarder is, as above, go read the documentation!
http://docs.splunk.com/Documentation/Splunk/5.0/Deploy/Typesofforwarders

coldface
Engager

Find the reason:
If i enable SplunkLightForwarder,it will not start Splunk web service
i modify $SPLUNK_HOME/etc/apps//SplunkLightForwarder/(local|default)/app.conf and set "state = disabled." and restart the splunk service,then it works.

Anyone can explain why so?

davidozvaldic
New Member

If Splunk Light Forwarder is enabled, Splunk Web is automatically disabled.
See documentation.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...