Try to start Splunk using command line(terminal), Use the following command to start Splunk from terminal, /Applications/Splunk/bin/splunk start Once it completes it provides a URL to access Splunk, sample output of the command is given below, root:~$ /Applications/Splunk/bin/splunk start Splunk> Finding your faults, just like mom. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbucket history main service_stats summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/Applications/Splunk/splunk-7.1.2-a0c72a66db66-darwin-64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done Waiting for web server at http://127.0.0.1:8000 to be available..... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://127.0.0.1:8000 And to check the status use the following command, /Applications/Splunk/bin/splunk status And to stop Splunk, use the following command, /Applications/Splunk/bin/splunk stop Hope it helps! ... View more

It is due to the OR condition you have in your search query. index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" OR component=root OR component=Metrics | rest of the search It will bring all records which satisfies anyone of the condition, and when a record is found with "component=root" it is of sourcetype splunk_web_service. So, if you don't want records from a particular sourcetype you can either filter that out using where clause or you can update your search to have AND condition as shown in the below command, index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" AND (component=root OR component=Metrics) |rest of the search ... View more

I have recently faced this issue when I was setting up my Splunk server on a remote machine. Sometimes it happens that the port you want to use is already in use by other service or it is not available to the user which you are using to start Splunk. In that case, you either need to change the port or the user. There is not much of a setting you need to change, you can use the following ways to change the mgmt port, 1. Change the management port using CLI, splunk set splunkd-port 9089 Source: https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Changedefaultvalues 2. Change the management port by updating the configuration file(web.conf), You will find the below line in the conf file and update it with the port of your choice, mgmtHostPort = 127.0.0.1:9089 Hope it helps! ... View more