Why am I getting "ERROR: The http port [8000] is already bound." trying to start Splunk after installation on Linux?

[gurinderbhatti]

I am installing the splunk package and after untaring the pkg on a linux box i am trying to start splunk (tried both as root and as a splunk user)
and getting the below error:

Checking prerequisites...
Checking http port [8000]: already bound
ERROR: The http port [8000] is already bound. Splunk needs to use this port.
Would you like to change ports? [y/n]: n
Exiting....

checking output of netstat reveals the following:

[root@hostA ~]# netstat -na | grep 8000
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN

Any ideas how i can get splunk to start running?

[vnguyen46]

I would add this :
Run: lsof -i :8000
Then note the record with PID
Run: kill -9 PID#
Then restart splunk.

[sibanandapani1]

try running lsof -i :8000

you will be able to find, one process running with root.py (python process)

once you will kill that process, kill -9 you will be able to bring up on 8000 port.

[gurinderbhatti · Accepted solution]

there was a python process which was tied to this somehow, killed that process and was able to start the splunk daemon.

[sbrant_splunk]

It appears that there is some process already listening on that port. You can always choose an alternate port for Splunk, which may be easier than changing whatever the other process is. You can check to see what the other process is by running:

lsof -i :8000