https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32758#M901 <P>Like I said, d'oh!</P> <P>Yes, that was the problem. I am afraid I looked at everything but the most obvious.</P> <P>Thank you very much.</P> Sat, 10 Dec 2011 04:24:49 GMT bnklein 2011-12-10T04:24:49Z https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32756#M899 <P>I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors. </P> <P><STRONG>However I am unable to to connect to splunkweb.</STRONG> </P> <UL> <LI><P>I am running under a trial license. </P></LI> <LI><P>I have changed the default admin password. </P></LI> <LI><P>As per the "What's Splunk Web" page, I have added <BR /> [general]<BR /> allowRemoteLogin = always<BR /> to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as<BR /> $SPLUNK_HOME/etc/system/local/server.conf (which did exist)</P></LI> <LI><P>I have confirmed the splunkweb python task is running.<BR /><BR /> 'splunk show web-port' shows Web-port: 8000<BR /> lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000). </P></LI> <LI><P>Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).</P></LI> <LI><P>splunkd_access.log shows for each access:</P></LI> </UL> <P>127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms</P> <UL> <LI>The web_service.log does not show any errors.</LI> <LI></LI> <LI>I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)</LI> </UL> <P>Any ideas? I'm certain it's one of those late Friday night d'oh's.</P> <P>Thanks,</P> <P>bk</P> Mon, 28 Sep 2020 10:12:56 GMT https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32756#M899 bnklein 2020-09-28T10:12:56Z https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32757#M900 <P>Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?</P> Sat, 10 Dec 2011 02:31:22 GMT https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32757#M900 dwaddle 2011-12-10T02:31:22Z https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32758#M901 <P>Like I said, d'oh!</P> <P>Yes, that was the problem. I am afraid I looked at everything but the most obvious.</P> <P>Thank you very much.</P> Sat, 10 Dec 2011 04:24:49 GMT https://community.splunk.com/t5/Deployment-Architecture/Cannot-access-splunkweb-after-initial-install/m-p/32758#M901 bnklein 2011-12-10T04:24:49Z