Why am I getting connection resets after installing and restarting the Splunk App for VMware on Splunk 6.2.1?

[rdrr66]

Working on a POC.

Installed splunk 6.2.1 logged in and changed the admin passwd. I then was able to install a few apps, Splunk App for Unix and Linux, and the example dashboard. Restarted and everything looked good. Then I went to install Splunk App for VMware, by unzipping splunk_app_vmware-3.1.3-246514.zip in the $SPLUNKHOME directory as the splunk user. Restart the application and now I am getting connection resets.

In the splunkd.log

02-05-2015 16:55:30.036 -0500 WARN  HttpListener - Socket error from X.X.X.X while idling: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

If I remove the Splunk App for VMware, splunk works fine. I have gone through the default install twice and had the same result each time.

[David · Accepted solution]

It looks to me like you're trying to connect to http://x.x.x.x/ and Splunk is expecting https://x.x.x.x/. Many premium Splunk apps will enable SSL by default (you should do it anyway!), but it can be surprising if you miss the warning. Try connecting on https and see if you're able to get to Splunk.

I was able to find this same error with that solution by googling for the error message (it's not Splunk specific, thankfully):
http://stackoverflow.com/questions/20047840/lighttpd-ssl-error
http://stackoverflow.com/questions/24175755/ssl-error-on-tornado-server

[rdrr66]

Thanks that was it, guess I missed that in the install guide. Shouldn't rush through those things...

[Masa]

The message itself is the server was SSL-enabled but it received a non-SSL HTTP request. VMware app enabled splunkweb SSL. Any proxy between your browser and the Search head?

[cam343]

I know this is an old thread, but further to this my issue was that ...etc/system/local/server.conf had:

enableSplunkdSSL = false

In it, removing that line / setting it to true fixed my issue

[Masa]

Thank you, cam343. It is good to know non-SSL splunkd will cause this issue, too.