topic clean install, no web interface in Installation

clean install, no web interface

drthornt — Tue, 05 Mar 2013 22:34:01 GMT

I just finished a nice clean install in Centos 6.3:

[root@server tmp]# /etc/init.d/splunk start
... snip ...
Checking prerequisites...
        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking configuration...  Done.
        Checking indexes...
                Creating: /opt/splunk/var/lib/splunk
                Creating: /opt/splunk/var/run/splunk
                Creating: /opt/splunk/var/run/splunk/appserver/i18n
                Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css
                Creating: /opt/splunk/var/run/splunk/upload
                Creating: /opt/splunk/var/spool/splunk
                Creating: /opt/splunk/var/spool/dirmoncache
                Creating: /opt/splunk/var/lib/splunk/authDb
                Creating: /opt/splunk/var/lib/splunk/hashDb
                Validated databases: _audit _blocksignature _internal _thefishbucket history main summary
        Done
New certs have been generated in '/opt/splunk/etc/auth'.
        Checking filesystem compatibility...  Done
        Checking conf files for typos...        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...  Done
                                                           [  OK  ]
Starting splunkweb...  Generating certs for splunkweb server
Generating a 1024 bit RSA private key
...................................++++++
...................++++++
writing new private key to 'privKeySecure.pem'
-----
Signature ok
subject=/CN=server/O=SplunkUser
Getting CA Private Key
writing RSA key
                                                           [  OK  ]
Done

If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://server:8000

So that's all looks good. I try with my browser and I get kicked out "Connection timeout"

[root@server tmp]# telnet 10.10.10.249 8000
Trying 10.10.10.249...
Connected to 10.10.10.249.
Escape character is '^]'.
GET / HTTP/1.1
Host: server

HTTP/1.1 303 See Other
Content-Type: text/html;charset=utf-8
Location: http://server/en-US/
Content-Length: 100
Server: CherryPy/3.1.2
Date: Tue, 05 Mar 2013 13:32:46 GMT
Set-Cookie: session_id_8000=d81e90d94a7dcadca73f83118e3ce704ef590989; expires=Wed, 06 Mar 2013 13:32:46 GMT; httponly; Path=/

This resource can be found at http://server/en-US/.Connection closed by foreign host.
[root@server tmp]#

What am I doing wrong?

Re: clean install, no web interface

Ayn — Tue, 05 Mar 2013 22:55:53 GMT

Looks OK to me? You obviously have connectivity so whatever issues you are experiencing sound more like browser related than Splunk related...

Re: clean install, no web interface

vincesesto — Wed, 06 Mar 2013 00:51:30 GMT

Are you seeing any errors in your logs, eg; web_access logs in /opt/splunk/var/log/splunk/ or are you getting no connection to the server at all?

Re: clean install, no web interface

jonuwz — Wed, 06 Mar 2013 10:35:35 GMT

If you use a proxy for your browser, you need to make sure there's exceptions so that it doesn't go out on the internet to get to the address.

Change the browser config to not use a proxy to test this.

Re: clean install, no web interface

dglinder — Wed, 06 Nov 2013 20:43:49 GMT

Are you running the browser from the same server, or is this your laptop connecting to it remotely? If so, check to make sure the iptables on your system isn't blocking port 8000 from the outside world.

Re: clean install, no web interface

grijhwani — Thu, 07 Nov 2013 03:24:45 GMT

The example you show with telnet suggests no fault. However, testing from the server to itself is not going to establish that your connection is allowed from another system. One presumes that since you are testing from the command line with telnet that you are not using a local browser.

Is the browser you ARE using on the same network segment? Are there intervening firewalls?

Are you running local firewall rules? Have you created an additional rule to allow access to port 8000 from other sources?