Why am I not able to access the Splunk web server?

[chandana204]

Hi, I am new to Splunk Enterprise admin level stuff. I have installed splunk enterprise successfully but not able to access web server. I followed below steps.
1. Created AWS EC2 RHEL single Instance.
2. Installed Putty on my windows to integrate EC2 instance.
3. Installed Splunk Enterprise successfully. I can see below message after started splunk service

4. Then I tried to open the web interface link in my windows chrome as mentioned in the above image. But I am seeing error message as "This site can't be reached, the web server IP address could not be found"
5. I checked web.conf file, web port: 8000, startwebserver=1 and I checked whether the port (8000) is open or not using nmap query. I can see ports are open for web server link (local host) and web interface link (my EC2 instance link). One more thing is when I check splunk status I don't see splunk webserver PID.

I am not sure where am I making a mistake. Please help me out with this issue.

Thanks in advance,
Chandana

[ghantk1]

To allow traffic on port 8000, you must configure the associated security group and network access control list (network ACL).

Here is the link on aws docs for a website to be hosted and I used the same steps to make it work in initial days:
https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/

[PowerPacked · Accepted solution]

Hi @chandana204

if everything is good with the ports opened,

you should try with ipv4 name in instance description of ec2 instances and 8000 port.

Thanks

[chandana204]

I didn't get you. Can you please explain a little bit more.

Thanks,
Chandana

[PowerPacked]

Can you give try with Public DNS (IPV4) listed in aws console.

Thanks

[chandana204]

I tried yesterday with Public DNS, it didn't work. I stopped the EC2 instance and started, it created new public DNS. Now i tried with the new public DNS (IPV4), It worked well.

Thanks,
Chandana

[tpeveler_splunk]

chandana204,

The Splunk web interface shown at startup is typically the AWS EC2 instance Private DNS or internal IP address. You will want to use the public DNS or public IP address for the EC2 instance. You can get that information on the description tab for the EC2 instance within the AWS console.

Also, check the AWS security group associated with your EC2 instance and make sure that there is an inbound TCP rule for port 8000.

[chandana204]

I am using Private DNS as web server link. Port 8000 is opened in EC2 Security group.

[tpeveler_splunk]

You'll need to use the public DNS or public IP address for the EC2 Instance when accessing the Splunk Web UI. As I mentioned above, You can get that information on the description tab for the EC2 instance within the AWS console.

You don't have to do anything with your existing Splunk installation. For some reason when Splunk starts up it always seems to reference the AWS EC2 instance Private DNS entry.

[chandana204]

It's working with public DNS.

Thanks,
Chandana

[austintking1]

Have you opened port 8000 in your security groups for the EC2 instance?

[chandana204]

Port 8000 is opened in my EC2 instance security group.