topic Re: How to open Splunk instance from putty session? in Deployment Architecture

How to open Splunk instance from putty session?

sanjubaba — Thu, 17 Sep 2020 11:29:39 GMT

I have a Splunk instance hosted on linux machine. I connect to the linux machine using putty. I want to open my splunk web on windows machine where I have the putty.

How can I open it?

Please guide me through this.

Re: How to open Splunk instance from putty session?

thambisetty — Thu, 17 Sep 2020 11:35:22 GMT

splunk web runs by default port 8000 with SSL disabled.

Try below URL:

http://linux_ip_where_splunk_installed:8000

Re: How to open Splunk instance from putty session?

ITWhisperer — Thu, 17 Sep 2020 11:39:19 GMT

Connect to the web interface from a browser on your windows machine

My guess is that this doesn't work otherwise you wouldn't be asking the question.

So the question is, why isn't it working?

Firstly, is the web interface running on the linux box?

What ip address and port is it listening on?

Do you have a network route (through firewalls and the like) to that ip address and port from your windows machine?

Are there other ports available which have routes (you might be able to set up a stunnel on your linux box to listen on a port you can reach and redirect traffic to the linux web interface)?

Re: How to open Splunk instance from putty session?

sanjubaba — Thu, 17 Sep 2020 11:43:09 GMT

@thambisetty if i have two linux machines hosted on putty and both of them are having Splunk hosted on them.

Can this work in that case?

http://linux_ip_address:port 8000

or should I need to provide different port number?

Re: How to open Splunk instance from putty session?

thambisetty — Thu, 17 Sep 2020 11:50:09 GMT

if i have two linux machines hosted on putty and both of them are having Splunk hosted on them.

you mean two splunk instances are running on single Linux machine? if that is your question, then you need to specify different port. two instance of Splunk cannot use same port.

First check splunk service is running on linux machine or not.

To do that:

ssh to Linux machine
ps -eaf | grep splunk
if you see anything like splunkd in the output of above command that means splunk is running.
Take the SPLUNK_HOME path like /opt/splunk/bin/splunkd ( bold is Splunk home path)

Next find web port:

/opt/splunk/bin/splunk show web-port ( this might prompt for authentication)

Re: How to open Splunk instance from putty session?

sanjubaba — Thu, 17 Sep 2020 12:13:55 GMT

@thambisetty I have two linux machines having single Splunk instance hosted on each of them.

In that case I don't need to specify different ports.

Right?

Re: How to open Splunk instance from putty session?

thambisetty — Thu, 17 Sep 2020 12:15:56 GMT

then you need to access each one of them using their IPs. Port would be same.

for example linux_machin1 then http://linux_machine1_ip:8000

linux_machine2 then http://linux_machine2_ip:8000