All Apps and Add-ons

Why am I not able to access the Splunk web server?

chandana204
Communicator

Hi, I am new to Splunk Enterprise admin level stuff. I have installed splunk enterprise successfully but not able to access web server. I followed below steps.
1. Created AWS EC2 RHEL single Instance.
2. Installed Putty on my windows to integrate EC2 instance.
3. Installed Splunk Enterprise successfully. I can see below message after started splunk service
alt text
4. Then I tried to open the web interface link in my windows chrome as mentioned in the above image. But I am seeing error message as "This site can't be reached, the web server IP address could not be found"
5. I checked web.conf file, web port: 8000, startwebserver=1 and I checked whether the port (8000) is open or not using nmap query. I can see ports are open for web server link (local host) and web interface link (my EC2 instance link). One more thing is when I check splunk status I don't see splunk webserver PID.
alt text

I am not sure where am I making a mistake. Please help me out with this issue.

Thanks in advance,
Chandana

0 Karma
1 Solution

PowerPacked
Builder

Hi @chandana204

if everything is good with the ports opened,

you should try with ipv4 name in instance description of ec2 instances and 8000 port.

Thanks

View solution in original post

ghantk1
Explorer

To allow traffic on port 8000, you must configure the associated security group and network access control list (network ACL).

Here is the link on aws docs for a website to be hosted and I used the same steps to make it work in initial days:
https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/

0 Karma

PowerPacked
Builder

Hi @chandana204

if everything is good with the ports opened,

you should try with ipv4 name in instance description of ec2 instances and 8000 port.

Thanks

chandana204
Communicator

I didn't get you. Can you please explain a little bit more.

Thanks,
Chandana

0 Karma

PowerPacked
Builder

Can you give try with Public DNS (IPV4) listed in aws console.

Thanks

0 Karma

chandana204
Communicator

I tried yesterday with Public DNS, it didn't work. I stopped the EC2 instance and started, it created new public DNS. Now i tried with the new public DNS (IPV4), It worked well.

Thanks,
Chandana

0 Karma

tpeveler_splunk
Splunk Employee
Splunk Employee

chandana204,

The Splunk web interface shown at startup is typically the AWS EC2 instance Private DNS or internal IP address. You will want to use the public DNS or public IP address for the EC2 instance. You can get that information on the description tab for the EC2 instance within the AWS console.

Also, check the AWS security group associated with your EC2 instance and make sure that there is an inbound TCP rule for port 8000.

chandana204
Communicator

I am using Private DNS as web server link. Port 8000 is opened in EC2 Security group.

0 Karma

tpeveler_splunk
Splunk Employee
Splunk Employee

You'll need to use the public DNS or public IP address for the EC2 Instance when accessing the Splunk Web UI. As I mentioned above, You can get that information on the description tab for the EC2 instance within the AWS console.

You don't have to do anything with your existing Splunk installation. For some reason when Splunk starts up it always seems to reference the AWS EC2 instance Private DNS entry.

0 Karma

chandana204
Communicator

It's working with public DNS.

Thanks,
Chandana

0 Karma

austintking1
New Member

Have you opened port 8000 in your security groups for the EC2 instance?

0 Karma

chandana204
Communicator

Port 8000 is opened in my EC2 instance security group.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...