topic Re: How can i know what is the web ui address of new installed splunk? in Splunk Enterprise

How can i know what is the web ui address of new installed splunk?

jadengoho — Tue, 22 May 2018 02:11:56 GMT

I installed a new Splunk enterprise in the box ,
We are using a cluster environment , and we have 2 different IP address .
Example : 10.80.246.100 - internal ip
10.80.243.32 - is the web (this is given by the previous splunk team)

Is there a way i can find the web ui address of the splunk ?
I already tried web.conf = 127.0..0.1:8089 ( just showing splunkd)

Re: How can i know what is the web ui address of new installed splunk?

mayurr98 — Tue, 22 May 2018 05:56:05 GMT

restart Splunk on the command line, ./splunk restart
check the URL and port of Splunk web provided at the end of the launch output.
verify if you need HTTP or HTTPS
(default should be http://localhost:8000)

Re: How can i know what is the web ui address of new installed splunk?

jadengoho — Tue, 22 May 2018 06:46:56 GMT

I did restart and this is what is see:
Splunk> The Notorious B.I.G. D.A.T.A.

Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration...  Done.
        Checking critical directories...        Done
        Checking indexes...
                Validated: _audit _internal _introspection _telemetry _
        Done


Bypassing local license checks since this instance is configured with a remote license master.

        Checking filesystem compatibility...  Done
        Checking conf files for problems...
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from '/opt/splunk/splunk-7.0.0-c8a78efdd40f-linux-2.6-x86_64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
Done
 [  OK  ]

Waiting for web server at https://127.0.0.1:8000 to be available... Done


If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at https://<hostname>:8000

But, as i mention . previous team set it in 2 diffrent network :
10.80.246.100 - internal ip
10.80.243.32 - is the web (this is given by the previous splunk team)

now the restart shows :"8000" , - ERROR page
https://:8000 - Error page ,
[Is there a way i can see what address/network is the UI of the new install app displaying ?

Re: How can i know what is the web ui address of new installed splunk?

xpac — Tue, 22 May 2018 07:42:06 GMT

By default it should be available on all IP addresses.

You can try netstat -tulpan | grep 8000 to see where Splunk is actually listening.

Re: How can i know what is the web ui address of new installed splunk?

jadengoho — Tue, 22 May 2018 07:58:12 GMT

I will try this , and also ask our infra team , if they knew about this matter , thanks xpac .