topic Re: Splunkweb Installation in Deployment Architecture

Splunkweb Installation

antg334 — Wed, 28 May 2014 15:28:18 GMT

What are the steps needed to install Splunkweb on a Linux server?

Re: Splunkweb Installation

MuS — Wed, 28 May 2014 15:58:41 GMT

Hi antg334,

download your favorite source format like rpm, deb or tgz and install or unpack it on your server. Find all information needed in the docs about installation.

cheers, MuS

Re: Splunkweb Installation

antg334 — Wed, 28 May 2014 16:14:47 GMT

I have already downloaded the rpm, which is an older version, 6.0.3 and installed it on the server but I am not seeing Splunkweb within the installation. So whenever I try to connect to Splunkweb I always receive an unable to display this page.

Re: Splunkweb Installation

grijhwani — Wed, 28 May 2014 16:28:23 GMT

Then you asked the wrong question. The issues that could possibly stop the page displaying are many and varied, and only a few relate to the Splunk installation itself.

Have you performed basic triage to isolate the problem? Are you directing your query to the right address and port? Are yo usure you can even reach the server? Have you performed a netstat on the server to see whether the process is attached to the correct port? Have you performed a tcpdump to ensure that your browser packets are reaching the server? What leads you to think the fault lies with Splunk?

Re: Splunkweb Installation

linu1988 — Wed, 28 May 2014 16:50:51 GMT

by any chance is it a forwarder installer? 😄

Re: Splunkweb Installation

antg334 — Wed, 28 May 2014 19:17:50 GMT

I have done a majority of the steps you listed in your triage, except the tcpdump. What leads me to believe it lies in Splunk is that I was able to connect previously before I upgraded the version. This is on an Indexer.

Re: Splunkweb Installation

MuS — Wed, 28 May 2014 19:34:43 GMT

Execute

$SPLUNK_HOME\bin\splunk status

Do you see splunkweb listed?

Re: Splunkweb Installation

antg334 — Wed, 28 May 2014 19:45:45 GMT

It states that splunkweb is not running. I have tried splunk restart splunkweb but get the same message. I even tried splunk start splunkweb and received absolutely nothing from that.

Re: Splunkweb Installation

MuS — Wed, 28 May 2014 19:54:50 GMT

 $SPLUNK_HOME\bin\splunk enable webserver
 $SPLUNK_HOME\bin\splunk start splunkweb

Re: Splunkweb Installation

antg334 — Thu, 29 May 2014 13:25:00 GMT

It is prompting me for a Splunk username and password. I tried using the local account but it states that the login failed. Where can I find the account information this is looking for?

Re: Splunkweb Installation

MuS — Thu, 29 May 2014 17:32:08 GMT

okay try admin and changeme which is the default. if this does not work make a backup of $SPLUNK_HOME/etc/passwd remove the same file and restart Splunk. After that you will be able to login using the default admin and changeme.
If you had any other users beside admin in $SPLUNK_HOME/etc/passwd simply copy/paste them back into the new $SPLUNK_HOME/etc/passwd file

Re: Splunkweb Installation

MuS — Thu, 19 Jun 2014 14:21:37 GMT

Please mark this question as answered - thx