Rather, because your folder was created on a different installation of Windows you no longer have NTFS security permissions to access (read) the folder.Ĭorrect this by following these steps to take ownership and then grant yourself full access to the folder. The problem isn't that the folder is Read Only. Most likely this is: C:\Program Files\Splunk\var\lib\splunk\kvstore\ Secondarily, maybe look at areas like index=_internal sourcetype=splunk_web_accessĪnd see what it does when you try to access a web page for it and get that error.Ģ) Check those logs and see if they lead anywhere useful or offer any hints.For Windows, if you face this error, you need to take ownership of the kvstore folder, and assign Full Control to System and Administrators (they most likely have "Special Permissions"). I also tried to find a logging setting for any of the web service so we could crank it up to debug, but a quick search shows it doesn't have it's own, well named logging facility. If those don't show much, drop even the ERROR OR WARN off it,restart and look at the whole set of splunk_web_service logs. Or even index=_internal sourcetype=splunk_web_service (ERROR OR WARN) Try checking index=_internal sourcetype=splunk_web_service (engine OR proxied) Have you opened a support ticket? That's what I'd be doing, even if in tandem with this process here. Still, my previous answer may be useful to other folks, so we'll leave it. I mean, probably, but just that I am not longer as sure of it. Now that you've clarified it a bit, I'm not quite as positive the web server IS actually running. Why are you doing full desktop installs? Probably all sorts of weird things that could go wrong in that. Speaking of which, I have to admit it's been a decade or more since I had a full windowing system on a linux server to even *try* using the "local web browser" to browse a local "web site". I suspect you'll find a massive facepalm at some point, but for now if it's working from actual client workstations, is there actually any problem? Could you try that please and let us know? I see no mention of trying a web browser from another machine pointed to this machine's IP address and port 8000. I suspect the problem is actually your web browser or something higher up the stack. And in fact, that response sort of indicates the web server IS running, and working correctly enough to identify that it was an invalid request and to send back and error message to your telnet session. I just tested that my perfectly fine, working server gives exactly that same response. That Bad Request is exactly what you should get - an "escape character" isn't a valid HTML request. I'm running out of options on how to debug this issue as to why the web server is not loading. I can't seem to find anything on the splunkd.log too. The only valuable info I receive on using the "Escape character" after the telnet connection isĤ00 Bad RequestBad RequestHTTP Request was malformed. So I believe that there is no firewall issue as well. I have checked if its the firewall issue, with performing a telnet 127.0.0.1 8000, as well as telnet 0.0.0.0 8000 and it gets connected The netstat -an | grep 8000 shows that it is listening on this port Note: None of the configurations have been changed. Except for on one server, we cannot access the splunk web interface via localhost. Also keeping the cret file the same throughout. So far we have installed more than 5 Splunk Enterprise on each Linux (RHEL) VM, following the standard installation procedure. We have been installing Splunk Enterprise on various virtual servers each for a Search Head, Indexer, HF. But I don't find a desirable solution to this. I know this question has been asked a several times over.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |