Why can't I access Splunk web interface?

chandra777 — Mon, 18 Jul 2022 13:59:56 GMT

Hi,

I am unable to access splunk web interface.

I have taken 1 ec2 instance from aws Red Hat Enterprise Linux 7 with High Availability

installed the splunk in /opt

[root@ip-172-31-82-137 splunk]# netstat -an | grep 8000
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN

[root@ip-172-31-82-137 splunk]# sestatus
SELinux status: disabled
[root@ip-172-31-82-137 splunk]#

sudo ./splunk restart
Stopping splunkd...
Shutting down. Please wait, as this may take a few minutes.
.. [ OK ]
Stopping splunk helpers...
[ OK ]
Done.

Splunk> Take the sh out of IT.

Checking prerequisites...
Checking http port [8000]: open
Checking mgmt port [8089]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _configtracker _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
Checking default conf files for edits...
Validating installed files against hashes from '/opt/splunk/splunk-9.0.0-6818ac46f2ec-linux-2.6-x86_64-manifest'
All installed files intact.
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...
PYTHONHTTPSVERIFY is set to 0 in splunk-launch.conf disabling certificate validation for the httplib and urllib libraries shipped with the embedded Python interpreter; must be set to "1" for increased security
Done
[ OK ]

Waiting for web server at http://127.0.0.1:8000 to be available.............. Done

If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://ip-172-31-82-137.ec2.internal:8000

******************************************************************************************

I see error under web_service log

2022-07-16 06:55:45,844 INFO [62d260ef597f205fe25d10] root:733 - CONFIG: error_page.default (method):
<bound method ErrorController.handle_error of
<splunk.appserver.mrsparkle.controllers.error.ErrorController object at 0x7f205e9e6090>>

Re: can't access web interface

VatsalJagani — Sun, 17 Jul 2022 08:22:20 GMT

@chandra777 - It seems firewall/network issue.

Generally, port accesses are blocked by default, specifically HTTP.
You need to enable HTTP inbound traffic on port 8000.
one of the this reference should help:
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/authorizing-access-to-an-instance.html
- https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/

I hope this helps!!!

topic Why can't I access Splunk web interface? in Installation

Why can't I access Splunk web interface?

Re: can't access web interface