Troubleshooting

Troubleshooting

I type in a term I know is in my data. Why don't I get any results?

Splunk indexes data by breaking it into segments. It searches for exact matches. If you type in "foo," Splunk expects to find a segment that is an exact match to "foo." It won't match "sfoo" or "food." For these types of searches, you can use the * as a wildcard (e.g."*foo" or "foo*").

If that doesn't work, start with a more broad search, such as "meta::all." To see how Splunk has broken your events into segments, mouse over a result - each separate string that highlights is a separate segment.

I go to the URL for my Splunk server and there's nothing there. What do I do?

First, make sure you have the right server URL. Try to telnet or ssh to the host. If you can login, check to see if both Splunk processes are running. At the shell prompt, type $SPLUNK_HOME/bin/splunk status. Or just use the ps command. You should see two processes - splunkd and splunkweb (twistd.py).

Restart the Splunk server by typing "splunk restart." It should report [ OK ] for both splunkd and splunkWeb.

Splunk starts but Splunkd won't start. What do I do?

Make sure you have the correct path when you are starting Splunk. The best way to verify this is to navigate into $SPLUNK_HOME/bin and type ./splunk restart. ($SPLUNK_HOME is the path you installed in). If Splunk still won't start, contact support.

The webserver is saying splunkd is down but it isn't. What is the matter?

The webserver needs to connect to the splunk daemon via the management port; by default this port is 8089. The most common reason for this error is the webserver is unable to connect to this port. Some good things to check

• Is there a firewall that is blocking access to the management port
• Can the system resolve localhost
• Is there another instance of Splunk running on this machine

I'm running low on disk space. What do I do?

See our Admin Manual section on Index Management.

I've made some config changes, but I'm not sure if they're working.

See the Admin Manual section on Testing Configuration Changes.

My 2.x license doesn't work with 3.0

Version 3 introduces a new license key format. If you are an existing 2.x customer your license will not work with 3.0. Plus Support customers are entitled to upgrade their 2.x license to 3.0. Please contact Splunk Support for your 3.0 license.

If you are using the free license you can perform the following steps:

• Stop Splunk (./splunk stop)
• Copy $SPLUNK_HOME/etc/splunk-free.license to $SPLUNK_HOME/etc/splunk.license
• Start Splunk (./splunk start)

I can't export results in Internet Explorer 6

There is a bug in Internet Explorer with regard to file downloads over SSL. The problem and resolution are documented here

• Was this topic useful?
• Post a comment