Hi @chinmoya : when ran the command while the splunkd was not running got the following output - [root@localhost bin]# ./splunk show web-port splunkd 8626 was not running. Stopping splunk helpers... [ OK ] Done. Stopped helpers. Removing stale pid file... done. Web port: 8000 With splunkd running, same command prompted for Splunk username & password. When the default credentials were entered admin/changeme system prompted with login failed error [root@localhost bin]# ./splunk show web-port Splunk username: admin Password: Login failed ... View more

Hi @ashajambagi : These were the only errors seen in splunkd.log - 01-20-2020 08:33:05.655 +0530 ERROR ProcessRunner - helper process seems to have died (child killed by signal 15: Terminated)! 01-20-2020 08:33:05.655 +0530 WARN EventLoop - ProcessRunner: about to throw an EventLoopException: error from PolledSocket write: Broken pipe 01-20-2020 08:33:05.656 +0530 ERROR ProcessRunner - got exception while running ProcessRunner's EventLoop: ProcessRunner: about to throw an EventLoopException: error from PolledSocket write: Broken pipe ... View more

Thanks @woodcock for sharing your inputs. Did check and found no errors logged in web_service.log ... View more

Thanks for your reply @soumyasaha25. Was finally able to locate web.conf which is under /opt/splunk/etc/system/default/ . Absolutely new to splunk so learning the basics 🙂 httpport is set as 8000 and startwebserver is 1 in web.conf. Here's the output when started the splunk process today if this helps - [root@localhost bin]# ./splunk start Splunk> CSI: Logfiles. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _metrics _telemetry _thefishbucket history main summary Done Checking filesystem compatibility... Done Checking conf files for problems... Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-8.0.1-6db836e2fb9e-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at http://127.0.0.1:8000 to be available..... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://192.168.122.1:8000 [root@localhost bin]# ./splunk status splunkd is running (PID: 8626). splunk helpers are running (PIDs: 8633 8646 8723 8758 8983). ... View more