topic Re: Cannot get into webUI, tried everything I can think of in Splunk Enterprise

Cannot get into webUI, tried everything I can think of

antrovira — Sat, 20 Feb 2021 06:34:53 GMT

Hello,

I am attempting to install splunk on a fresh install of an ubuntu server 20 VM. This VM is on ESXi, with a pfSense VM running to route traffic, and a few other VM's to create a malware analysis lab. My issue right now, is I cannot seem to get into the web interface for Splunk Enterprise.

I have tried several things; I have made sure that splunk is running on port 8000 and listening, I have disabled iptables, added a pass everything rule on each of my pfSense interfaces, ensured that it is started, the status says that it started correctly, and no errors in the log files. I am currently able to ping from the VM that splunk is on to my laptop, but am not able to ping from my laptop to my VM. I can open any of the other VM's.

I opened wireshark and attempted to look at what was happening, and it seems that when I send a ping to the laptop from the splunk vm, it comes through to my laptop successfully. When i send it from my laptop to the VM, it does not get any response and keeps retrying the packets.
Can anyone help?

Re: Cannot get into webUI, tried everything I can think of

gbeatty — Mon, 22 Feb 2021 04:57:17 GMT

Are you able to telnet to port 8000 on the Splunk server? Are you able to connect to any other ports? I am assuming yes. Additionally, if it is a fresh install of Splunk Enterprise then HTTPS is likely disabled. If your browser is automatically rerouting all requests to HTTPS, you may not be able to connect. Turn off anything like HTTPS Everywhere or any applicable browser settings and try to reach the HTTP page explicitly. Lastly, from my experience with Splunk on Ubuntu is that it comes with UFW enabled and not iptables. Have you double checked there isn't another host based firewall?

Apologies if these seems simple, but you've already done a lot of troubleshooting steps that I would perform.

Re: Cannot get into webUI, tried everything I can think of

antrovira — Thu, 25 Feb 2021 19:19:24 GMT

I have tried to telnet from my laptop to the splunk machine and cannot do so. However, I can telnet and ping out to my laptop from the splunk machine. The UFW is disabled (double checked), and this is a fresh install with nothing else configured. Straight up, dpkg -i "filename" install with nothing done except these tests to check what the issue is.

Any other suggestions?