topic Re: Splunk Remote Login Issue in Security

Splunk Remote Login Issue

Marco — Thu, 14 Jan 2021 19:32:08 GMT

Hello,

I am running a Splunk Server on a windows VM. A few weeks ago Splunk was ungracefully shut off (Windows Server was rebooted, while Splunk was running). I was able to get Splunk up and running but, only on my local instance. Now other computers on my network cannot access Splunk.

I have checked the fire wall settings and everything is good
startwebserver = 1
After restarting Splunk It assures me that Port 8000 is open

In conclusion, I am able to access Splunk within that one computer. But after Splunk was shut down ungracefully, other computers on my network can no longer access Splunk.

Any help would be much appreciated.

Thank you

Marco

Re: Splunk Remote Login Issue

richgalloway — Thu, 14 Jan 2021 21:22:29 GMT

Sounds like a firewall problem. Yes, I know you checked that, but is it possible the server was assigned a new IP address after reboot and now doesn't comply with the firewall rules?

Re: Splunk Remote Login Issue

Marco — Fri, 15 Jan 2021 23:18:13 GMT

@richgalloway I appreciate your response, but for this specific situation our proxy server was the issue.

When the server shutdown unexpectedly something happened with our proxy settings, so we disabled the proxy server and where then able to access our Splunk application outside of our local instance.

To disable your proxy server:

Type the following on the start menu: Configure Proxy Server
Then click the Connections tab
In my case I clicked LAN Settings and unclicked all the boxes.

*Note disabling your proxy server should not be a long term solution(In my opinion)

Thank you,

Marco