topic Re: Not able to access Splunk Web after Splunk installation in Security

Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 06:20:21 GMT

I was trying to install Splunk 6.1.1 in CentOs 6.8.
Installation was successful and I was unable to access Splunk web interface.
Can anyone suggest me where I went wrong or what I missed out...

Re: Not able to access Splunk Web after Splunk installation

kamlesh_vaghela — Wed, 08 Nov 2017 06:24:39 GMT

Hi
I think it is firewall issue.

Can you please disable firewall ( JUST for testing) and check again?

Re: Not able to access Splunk Web after Splunk installation

Sukisen1981 — Wed, 08 Nov 2017 06:25:12 GMT

try tinkering the web url - http://localhost:8001/

Is this accessible?

Re: Not able to access Splunk Web after Splunk installation

hardikJsheth — Wed, 08 Nov 2017 07:42:50 GMT

I think it should be firewall issue. But in order to determine that Splunkd is currently listening on port 8000.

netstat -tulnp | grep 8000

If you get the output, that means Splunk is running fine and you need to tweak the firewall to allow incoming requests for following ports
8000 - Splunk Web
8089 - Splunk Management Port
8191 - KVStore

Re: Not able to access Splunk Web after Splunk installation

gcusello — Wed, 08 Nov 2017 07:43:42 GMT

Hi V4M51,
did you disabled iptables?

Disable / Turn off Linux Firewall (Red hat/CentOS/Fedora Core)
# /etc/init.d/iptables save
# /etc/init.d/iptables stop

Turn off firewall on boot:
# chkconfig iptables off

Enable / Turn on Linux Firewall (Red hat/CentOS/Fedora Core)
# /etc/init.d/iptables start

Turn on firewall on boot:
# chkconfig iptables on

on Centos 7
Status
systemctl status firewalld
disable
systemctl disable firewalld
stop
systemctl stop firewalld

Bye.
Giuseppe

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 08:07:55 GMT

yeah, I tried to enable Splunk on firewall bt did not work.
So as you suggested I disabled firewall and it works fine as of now.

thank you..

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 08:09:52 GMT

ports are enabled properly

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 08:10:14 GMT

after disabling firewall yes..

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 09:42:30 GMT

Hi Cusello can you help me how to enable Splunk on firewall without disabling firewall/iptabel

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Wed, 08 Nov 2017 09:43:03 GMT

Hi kamlesh_vaghela can you help me how to enable Splunk on firewall without disabling firewall/iptabel

Re: Not able to access Splunk Web after Splunk installation

gcusello — Wed, 08 Nov 2017 09:48:13 GMT

See at https://stackoverflow.com/questions/7423309/iptables-block-access-to-port-8000-except-from-ip-address

iptables -A INPUT -p tcp --dport 8000 -s 1.2.3.4 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

Bye.
Giuseppe

Re: Not able to access Splunk Web after Splunk installation

kamlesh_vaghela — Wed, 08 Nov 2017 09:56:19 GMT

HI
1) enable firewall.
2) open port splunk ports.

See this link for list of ports: https://docs.splunk.com/Documentation/Splunk/7.0.0/InheritedDeployment/Ports

3) sudo iptables -I INPUT -p tcp -s 0.0.0.0/0 --dport 8000 -j ACCEPT

Re: Not able to access Splunk Web after Splunk installation

V4M51 — Thu, 09 Nov 2017 04:26:03 GMT

Thanks, this worked....

Re: Not able to access Splunk Web after Splunk installation

gcusello — Sun, 24 Jan 2021 17:36:20 GMT

Hi @hardikJsheth,

good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉