I am running Ubuntu 10.04 on an i386 machine.
I get this output:
steve@steve-laptop:/opt/splunk/bin$ sudo ./splunk start [sudo] password for steve: splunkd 5067 was not running. Stopping splunk helpers...
Done. Stopped helpers. Removing stale pid file... done.
Splunk> 4TW
Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking index directory... Done. Checking databases... Validated databases: _audit, _blocksignature, _internal, _thefishbucket, history, main, sample, summary All preliminary checks passed.
Starting splunk server daemon (splunkd)... Done. Starting splunkweb... Error starting splunkweb. steve@steve-laptop:/opt/splunk/bin$
I have checked web.conf, and that is set. I checked permissions, and they seem to be set too.
Any ideas or thoughts on what I should check next?
Take care.
Steve
What happens if you run: splunk restart splunkweb
Also, anything obvious in $SPLUNK_HOME/var/log/splunk/web_service.log ?
Which modules directory? I would expect Errno 2 on shutdown of splunkweb if it never started correctly. Is splunk running as a non-root user, by chance?
So, I renamed the "Modules" directory from "Modules.new" as I have residual files from an old Splunk installation on my machine.
SplunkWeb is still acting up, and the web_service.log is showing the following snippet of interest:
2010-12-01 11:05:55,955 WARNING [4cf6726329a3242cc] custompidfile:36 - Removing pidfile at /opt/splunk/var/run/splunk/splunkweb.pid (PID: 1796)"
2010-12-01 11:05:55,955 ERROR [4cf6726329a3242cc] custompidfile:42 - Unable to remove /opt/splunk/var/run/splunk/splunkweb.pid. [[Errno 2] No such file or directory: '/opt/splunk/var/run/splunk/splunkweb.pid']
Any ideas?