No Available Splunk Web Ports on AWS Instance

[seandevo]

I am currently hosting an Amazon Linux OS (EC2) on AWS, which is the same service that Splunk U uses. After sucessfully downloading and installing Splunk as a root user and starting it up for the first time, I changed the IP address of the default IP to the Public IP address AWS EC2 provided by adding the following line to /opt/splunk/etc/splunk-launch.conf:

SPLUNK_BINDIP:111.222.333.444

I also changed the mgmt ip and port under /opt/splunk/etc/system/local/web.conf:

When I tried to ./splunk restart, I get the error message saying: "Checking http port [111.222.333.444:8000]: already bound. ERROR: The HTTP Port [8000] is already bound. Splunk needs to use this port.

Even if I change the Port, it gives me the same error (with the new port number).

I checked "netstat -anp" and there was no port shown to be bound to the instance.

On the AWS side, I configured the security group to allow inbound connetion to TCP 8000, 8089, 80, and 443. Still no luck.

Anyone have advice? Thanks

Best Regards,
Sean Devo, Systems Engineer
pm2NET

[seandevo · Accepted solution]

I figured out why the ports were not working. AWS already provides a public IP and public domain name that will work even though the original install of splunk will give it a private IP host.

Long story short, when installing Splunk and starting it up for the first time, your webUI can be accessed with: publicIP:8000 found on your AWS EC2 instance dashboard. No need for 'SPLUNK_BINDIP' command.