Security

Why won't splunkweb start when I'm running splunk as 'splunk' user instead of root?

DerekB
Splunk Employee
Splunk Employee

I want to run Splunk as the user 'splunk' instead of the user 'root'.

I am following the instructions at http://docs.splunk.com/Documentation/Splunk/latest/installation/RunSplunkasadifferentornon-rootuser

When I run the command service splunk start, splunkd will start but splunkweb will not, and I cannot figure out why it won't start. I don't see any error messages.

Tags (1)

splunkIT
Splunk Employee
Splunk Employee

Assuming that splunkweb is configured to use the default port 8000, and you did not see anything insightful in the logs that sowings has mentioned, then try test starting up splunkweb with the following commands in $SPLUNK_HOME:


# cd splunk
# . bin/setSplunkEnv
# bin/python lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py start

If splunkweb fails to start using this method, you should see errors, otherwise you should only see a blinking cursor.

For example, in this case there was permission issues with the cpdispatch file:


Traceback (most recent call last):
File "lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 543, in
logger.error('Unable to start splunkweb')
File "/data/splunk/lib/python2.7/logging/
init.py", line 1158, in error
self._log(ERROR, msg, args, **kwargs)
File "/data/splunk/lib/python2.7/logging/
init.py", line 1249, in _log
record = self.makeRecord(self.namehttp://self.namehttp://self.namehttp://self.namehttp://self.namehttp://self.name, level, fn, lno, msg, args, exc_info, func, extra)
File "lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py", line 60, in makeRecord
from splunk.appserver.mrsparkle.lib.util import get_request_id
File "/data/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/
init.py", line 13, in
from lib.decorators import *
File "/data/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/decorators.py", line 2, in
import cherrypy
File "/data/splunk/lib/python2.7/site-packages/cherrypy/
init_.py", line 159, in
from cherrypy import _cpdispatch as dispatch
ImportError: cannot import name _cpdispatch

sowings
Splunk Employee
Splunk Employee

Have you configured it to use a port < 1024? If you've changed the configuration to be on the standard HTTP (80) or HTTPS (443) port, you'll need super-user privileges to start. Consider also checking the web_service.log or splunkd.log in $SPLUNK_HOME/var/log/splunk directory.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...