topic Re: Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser? in Security

Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser?

natedlee — Tue, 23 Feb 2016 17:13:33 GMT

I just installed Splunk Enterprise 6.0 and all went swimmingly. However, my connection is refused when trying to go to it in my browser. What am I missing?

Splunk> 4TW

Checking prerequisites...   Checking
http port [8000]: open  Checking mgmt
port [8089]: open   Checking
configuration...  Done.         Creating:
/opt/splunk/var/lib/splunk      Creating:
/opt/splunk/var/run/splunk      Creating:
/opt/splunk/var/run/splunk/appserver/i18n
        Creating:
/opt/splunk/var/run/splunk/appserver/modules/static/css
        Creating:
/opt/splunk/var/run/splunk/upload
        Creating:
/opt/splunk/var/spool/splunk
        Creating:
/opt/splunk/var/spool/dirmoncache
        Creating:
/opt/splunk/var/lib/splunk/authDb
        Creating:
/opt/splunk/var/lib/splunk/hashDb
    Checking critical directories...    Done
    Checking indexes...         Validated:
_audit _blocksignature _internal _thefishbucket history main summary    Done New certs have been generated in
'/opt/splunk/etc/auth'.     Checking
filesystem compatibility...  Done
    Checking conf files for typos... 
    Done All preliminary checks passed.

Starting splunk server daemon
(splunkd)...   Done
                                                           [  OK  ] Starting splunkweb... 
Generating certs for splunkweb server
Generating a 1024 bit RSA private key
........++++++ ...............++++++
writing new private key to
'privKeySecure.pem'
----- Signature ok subject=/CN=localhost.localdomain/O=SplunkUser
Getting CA Private Key writing RSA key
                                                           [  OK  ] Done

If you get stuck, we're here to help. 
Look for answers here:
http://docs.splunk.com

The Splunk web interface is at
http://xxx.xxx.xxx.xxx:8000

Re: Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser?

martin_mueller — Tue, 23 Feb 2016 21:07:44 GMT

Check that you've got the protocol, host name, port correct in the browser. If wrong, correct and try again.
Check that you can establish a connection, e.g. telnet to the host and port. If not, talk to network administration to fix.

That being said, go grab 6.3 - it's significantly improved over 6.0.

Re: Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser?

natedlee — Wed, 24 Feb 2016 01:30:03 GMT

I stopped the firewall and it worked fine - so something in my firewall settings is doing this.

I am trying to help a customer using our app and they aren't willing to upgrade to 6.3 yet for some reason - so I'm trying ti troubleshoot the older version with them. I'm just running 6.0 in a VM for these purposes.

Re: Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser?

earakam — Wed, 24 Feb 2016 08:25:51 GMT

Taking the fact that it worked fine with firewall disabled, I think you just need to open the right port for this. In this case, 8000.
Here is a good port digram
https://answers.splunk.com/answers/118859/diagram-of-splunk-common-network-ports.html

thanks.

Re: Splunk Enterprise starts, but why is my connection refused trying to access Splunk Web in my browser?

chandrasekharko — Mon, 29 Oct 2018 15:42:50 GMT

Check your management port numbers.