topic Re: Unable to access Splunk Web Portal in Installation

Unable to access Splunk Web Portal

sidtalup27 — Mon, 20 Jun 2022 19:10:56 GMT

Hello,

I have a new installation of Splunk 9.X. The instance is hosted on Ubuntu OS, on Azure Cloud. There is no Public IP associated with the instance. The instance can only be accessed via the associated Private IP Address (peering is established between Azure and my internal company network)

I tried to telnet the Instance on port 8000, and it is accepting connections. In parallel, when I launch TCPDUMP and refresh the browser, I can see packets on TCPDUMP.

Inspite, I am unable to access the instance via console. I get CONNECTION RESET on the browser.

Please advise.

--
Thanks,
Siddarth

Re: Unable to access Splunk Web Portal

PickleRick — Mon, 20 Jun 2022 20:29:38 GMT

You're trying to connect over unencrypted http to a https-enabled port or vice-versa?

Re: Unable to access Splunk Web Portal

sidtalup27 — Mon, 20 Jun 2022 20:46:47 GMT

@PickleRick , I tried both. over port 80 and 443, either way, I was unsuccessful.

Re: Unable to access Splunk Web Portal

PickleRick — Mon, 20 Jun 2022 20:57:43 GMT

No. I mean that by default Splunk does indeed listen on port 8000 for web ui connections (you can verify it on server side by using

netstat -lpt | grep splunkd

ss -lptn | grep splunkd

Your comment that you can access port 8000 with telnet suggests that it is so indeed.

So you should be connecting to your_ip:8000. The question is whether you have tls enabled in web server's configuration and should use https://your_ip:8000 or not and you should use http://your_ip:8000

Re: Unable to access Splunk Web Portal

sidtalup27 — Mon, 20 Jun 2022 21:21:01 GMT

@PickleRick , below is the output of netstat.

sadmin@splunk-01:~$ sudo netstat -lpt | grep splunkd
tcp 0 0 splunk:8000 0.0.0.0:* LISTEN 58145/splunkd
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN 58145/splunkd

sadmin@splunk-01:~$ sudo ss -lptn | grep splunkd
LISTEN 0 128 10.X.X.X:8000 0.0.0.0:* users:(("splunkd",pid=58145,fd=186))
LISTEN 0 128 0.0.0.0:8089 0.0.0.0:* users:(("splunkd",pid=58145,fd=4))

Can you please advise on ''tls enabled in web server's configuration"

--
Thanks,
Siddarth

Re: Unable to access Splunk Web Portal

PickleRick — Tue, 21 Jun 2022 07:03:42 GMT

OK. So splunkd is listening on ports 8000 (where webui should be) and 8089 (that port is for internal splunk uses). So theoretically you should be able to connect to that port using either plain http or https.

If you can't it means that there is something else blocking the connection. Maybe it's the host firewall, maybe you have some firewall in the middle of your network path, maybe you have some transparent proxy - we can't know that - it's your environment 😉

Try connecting to http://<your_ip>:8000 and https://<your_ip>:8000 and see if any of those work.

Typically "connection reset by peer" happens if you have TLS enabled bu try to connect using plain HTTP.

Re: Unable to access Splunk Web Portal

Sunil2 — Sat, 20 Jan 2024 13:26:53 GMT

@sidtalup27 I have the exact issue, there is nothing wrong with the port configuration on the vm and everything looks fine with NSG at Azure, but still facing issues with splunk web.

Were you able to solve the issue you had?