Splunkd is down

Splunkd is down

Sometimes Splunk's web interface will show you the message ""Splunkd appears to be down," when splunkd is definitely up and running. There are several potential causes.

No localhost entry in /etc/hosts

The Splunkweb interface is configured to connect to the splunkd daemon in this line in the file $SPLUNK_HOME/opt/splunk/etc/myinstall/search.xml.

<managerURL>http://localhost:8089</managerURL>

If your Splunk Server host has no entry for localhost in its /etc/hosts file, this will fail. Either add a localhost entry, or edit search.xml to change the managerURL entry from "localhost" to something that will resolve -- 127.0.0.1 or the DNS-supported hostname of the host.

Splunkd may need a few more seconds to come up

Sometimes the web server is ready to respond before the daemon. If you notice this after reboots, try putting a sleep delay or otherwise making the splunkweb (twistd.py) process wait before it launches.

Your license file contains line-breaks or other hidden characters

Some email clients have been inserting hidden characters (line-breaks, null characters, etc.) to the license string when it gets emailed to you. These hidden characters can break your license string causing Splunk to go down. To resolve this issue you should copy the license string from the store and paste it into your license file in $SPLUNK_HOME/etc/splunk.license.

• Was this topic useful?
• Post a comment