topic Re: Connect Splunk to the Internet to retrieve apps in Splunk Search

Connect Splunk to the Internet to retrieve apps

jrsanders — Thu, 23 Jan 2014 20:37:57 GMT

Hello,

I'm tying to add more apps to our Splunk Web GUI. Every time I click "Find More Apps" I get an error message saying "Splunk is unable to connect to the Internet to find more apps." We are running Splunk on Centos 6.5 and I'm not sure what to do. I'm fairly new to using both *nix and Splunk so any help would be appreciated.

Thank You
JS

Re: Connect Splunk to the Internet to retrieve apps

kristian_kolb — Thu, 23 Jan 2014 20:50:56 GMT

It seems that your Splunk server cannot reach the internet. Check that with your network team. If direct connection to the internet is forbidden in your organization, you can download the apps to your workstation and transfer them from there to your Splunk installation. Then, in the GUI, you choose "install from file" instead.

Hope this helps,

Re: Connect Splunk to the Internet to retrieve apps

jrsanders — Thu, 23 Jan 2014 21:22:52 GMT

Thank you for the response. They told me its a firewall issue. They asked me where the Web GUI is trying to connect to to get the apps. Not really sure how to answer their question.

Re: Connect Splunk to the Internet to retrieve apps

martin_mueller — Thu, 23 Jan 2014 21:37:33 GMT

I see Splunk resolve splunkbase.splunk.com before accessing online apps, so that's where it's connecting to.

Re: Connect Splunk to the Internet to retrieve apps

kristian_kolb — Thu, 23 Jan 2014 21:41:44 GMT

That seems likely - or perhaps apps.splunk.com.... aah, yes.. that resolves to the same IP.

The firewall guys should be able to pull the blocked connection out of their logs. Or - if you are already splunking them - you can do it yourself!

Re: Connect Splunk to the Internet to retrieve apps

mstegmueller — Mon, 28 Sep 2020 15:42:42 GMT

you could also ask them if there is a proxy, that you could use. if thats the case, just go to the cli on your splunkserver and add the env variables:
HTTP_PROXY=proxy:3128
HTTPS_PROXY=proxy:3128

add these to the /etc/bash.bashrc. after restarting splunk it should be able to connect.

Re: Connect Splunk to the Internet to retrieve apps

mkinsley_splunk — Fri, 24 Jan 2014 07:19:11 GMT

You can find this information directly in the config files . Here is the stanza from server.conf that lists the update servers

[applicationsManagement]
allowInternetAccess = true
url = https://splunkbase.splunk.com/api/apps
loginUrl = https://splunkbase.splunk.com/api/account:login/
detailsUrl = https://splunkbase.splunk.com/apps/id
updateHost = https://splunkbase.splunk.com
updatePath = /api/apps:resolve/checkforupgrade
updateTimeout = 24h

Re: Connect Splunk to the Internet to retrieve apps

jrsanders — Fri, 24 Jan 2014 13:51:14 GMT

Thank you all! This is a huge help 🙂

Re: Connect Splunk to the Internet to retrieve apps

tp92222 — Wed, 09 Mar 2016 12:19:53 GMT

i am facing same problem. can you please tell me what exactly you did to solve this problem .it will be really great help for me.

thank you