![]() I also tried to find a logging setting for any of the web service so we could crank it up to debug, but a quick search shows it doesn't have it's own, well named logging facility. If those don't show much, drop even the ERROR OR WARN off it,restart and look at the whole set of splunk_web_service logs. Or even index=_internal sourcetype=splunk_web_service (ERROR OR WARN) Try checking index=_internal sourcetype=splunk_web_service (engine OR proxied) Have you opened a support ticket? That's what I'd be doing, even if in tandem with this process here. Still, my previous answer may be useful to other folks, so we'll leave it. I mean, probably, but just that I am not longer as sure of it. Now that you've clarified it a bit, I'm not quite as positive the web server IS actually running. Why are you doing full desktop installs? Probably all sorts of weird things that could go wrong in that. Speaking of which, I have to admit it's been a decade or more since I had a full windowing system on a linux server to even *try* using the "local web browser" to browse a local "web site". I suspect you'll find a massive facepalm at some point, but for now if it's working from actual client workstations, is there actually any problem? Could you try that please and let us know? I see no mention of trying a web browser from another machine pointed to this machine's IP address and port 8000. I suspect the problem is actually your web browser or something higher up the stack. And in fact, that response sort of indicates the web server IS running, and working correctly enough to identify that it was an invalid request and to send back and error message to your telnet session. I just tested that my perfectly fine, working server gives exactly that same response. That Bad Request is exactly what you should get - an "escape character" isn't a valid HTML request. I'm running out of options on how to debug this issue as to why the web server is not loading. I can't seem to find anything on the splunkd.log too. The only valuable info I receive on using the "Escape character" after the telnet connection isĤ00 Bad RequestBad RequestHTTP Request was malformed. So I believe that there is no firewall issue as well. I have checked if its the firewall issue, with performing a telnet 127.0.0.1 8000, as well as telnet 0.0.0.0 8000 and it gets connected The netstat -an | grep 8000 shows that it is listening on this port Note: None of the configurations have been changed. Except for on one server, we cannot access the splunk web interface via localhost. Also keeping the cret file the same throughout. So far we have installed more than 5 Splunk Enterprise on each Linux (RHEL) VM, following the standard installation procedure. We have been installing Splunk Enterprise on various virtual servers each for a Search Head, Indexer, HF. But I don't find a desirable solution to this. ![]() I know this question has been asked a several times over.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |