I can not connect to splunk using AWS- Any ideas?

[ohhhvictor]

I am new to Splunk and I was trying to connect since last weekend..it keep me booting me out..Unable to connect
I was using Putty SSH
This is what I see

Any suggestions?

[Vijeta]

@ohhhvictor Check your web.conf in system/local has httpport=8000 , also check your server.conf for sslConfig stanza and see if it has sslPassword or not. In past trying to remove sslPassword and restarting splunk has worked for me.

[ohhhvictor]

so, so far the configuration on:

1. AWS
2. putty
3. Splunk

The are ok as you can see but I can not do anything..
Splunk is not loading the site anymore
What can be wrong?

[ohhhvictor]

it s not a matter of security group..I am allowing all traffic because I am learning , and I need to see traffic from different ports and monitor it

so port 443 and 8000 must be open as you can see

[ohhhvictor]

I was connected before in putty last week..I havent modify anything..
You mention to open port 443...Where ? in putty? I am connected through ssh., port 22 now

[PavelP]

Hello @ohhhvictor

I'm able to connect to this IP via SSH.

1. please edit the screenshot and mask the IP address 🙂 do it ASAP

2. make sure you're using strong splunk password. You can change it via SSH with

   su - splunk
   splunk edit user -auth admin: -password

3. check AWS security group -> inbound rules that 8000/TCP is allowed

4. check iptables with iptables-save that 8000/TCP is allowed

FYI: t2.micro is too small für Splunk

Let me know how it went

[ohhhvictor]

[ohhhvictor]

[codebuilder]

You have to open up ports 443 for SSH access and 8000 for web UI access in your "inbound rules".

[codebuilder]

Please don't respond with additional questions as "answers". Comment on only the original post or answer.

Are you using a Elastic Load Balancer (ELB) ?

[ohhhvictor]

no..should I ?

[ohhhvictor]

I am not an expert, but this is what I think:
I don't think that I need ELB , because I don't need to load balancing between several instances.. I only have one, as you could see

What do you think?