Security

Unable to access the splunk web portal using the URL http:// hostname:8000

Hemnaath
Motivator

Hi All, Currently we are facing an issue in accessing the splunk web interface, as soon as we hit the splunk URL http:hostname.com:8000 the portal goes in hung mode, so when checked into the splunkd.log, could see the below WARN message not sure what should be done to fix this issue.

splunkd.log details

07-12-2017 01:20:45.428 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499769163.453/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499769163.454/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499770963.455/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499770963.456/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499772763.457/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499772763.458/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499774563.459/metadata.csv
07-12-2017 01:20:45.429 -0400 WARN DispatchSearchMetadata - could not read metadata file: /opt/splunk/var/run/splunk/dispatch/SummaryDirector_1499774563.460/metadata.csv
07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting
07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting
07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting
07-12-2017 01:22:12.885 -0400 WARN HttpListener - Connection from 10.x.x.x didn't send us any data, disconnecting

Below ERROR tell that its unable to communicate with the indexer instances.
07-07-2017 10:02:43.320 -0400 ERROR SyslogOutputConfig - Syslog output server not in expected format. Please use : format
07-08-2017 01:33:00.065 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
07-08-2017 01:42:28.078 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed

07-08-2017 01:45:57.370 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
07-08-2017 01:46:57.211 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
07-09-2017 14:28:51.100 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
07-09-2017 14:32:20.308 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed
07-09-2017 14:32:20.309 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x:9997 failed
07-09-2017 14:32:50.140 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed
07-09-2017 14:33:49.829 -0400 ERROR TcpOutputFd - Connection to host=10.x.x.x failed

Kindly guide me how to fix the issue .

Tags (2)
0 Karma
1 Solution

Hemnaath
Motivator

Hi All the issue got resolved after clearing the catch from the browser, as it was taking the previous session when there was an issue with the splunk instance running in Heavy forwarder instance, same catch was stored in the browser and it was not reading it from splunk instance. After clearing the catch it started working.

thanks all.

View solution in original post

Hemnaath
Motivator

Hi All the issue got resolved after clearing the catch from the browser, as it was taking the previous session when there was an issue with the splunk instance running in Heavy forwarder instance, same catch was stored in the browser and it was not reading it from splunk instance. After clearing the catch it started working.

thanks all.

skoelpin
SplunkTrust
SplunkTrust

I converted your comment to the answer. Go ahead and accept it as the answer so you can close it out and allow others to reference this in the future

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...