All Apps and Add-ons

Why am I not able to access the Splunk web server?

Path Finder

Hi, I am new to Splunk Enterprise admin level stuff. I have installed splunk enterprise successfully but not able to access web server. I followed below steps.
1. Created AWS EC2 RHEL single Instance.
2. Installed Putty on my windows to integrate EC2 instance.
3. Installed Splunk Enterprise successfully. I can see below message after started splunk service
alt text
4. Then I tried to open the web interface link in my windows chrome as mentioned in the above image. But I am seeing error message as "This site can't be reached, the web server IP address could not be found"
5. I checked web.conf file, web port: 8000, startwebserver=1 and I checked whether the port (8000) is open or not using nmap query. I can see ports are open for web server link (local host) and web interface link (my EC2 instance link). One more thing is when I check splunk status I don't see splunk webserver PID.
alt text

I am not sure where am I making a mistake. Please help me out with this issue.

Thanks in advance,
Chandana

0 Karma
1 Solution

Builder

Hi @chandana204

if everything is good with the ports opened,

you should try with ipv4 name in instance description of ec2 instances and 8000 port.

Thanks

View solution in original post

Explorer

To allow traffic on port 8000, you must configure the associated security group and network access control list (network ACL).

Here is the link on aws docs for a website to be hosted and I used the same steps to make it work in initial days:
https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/

0 Karma

Builder

Hi @chandana204

if everything is good with the ports opened,

you should try with ipv4 name in instance description of ec2 instances and 8000 port.

Thanks

View solution in original post

Path Finder

I didn't get you. Can you please explain a little bit more.

Thanks,
Chandana

0 Karma

Builder

Can you give try with Public DNS (IPV4) listed in aws console.

Thanks

0 Karma

Path Finder

I tried yesterday with Public DNS, it didn't work. I stopped the EC2 instance and started, it created new public DNS. Now i tried with the new public DNS (IPV4), It worked well.

Thanks,
Chandana

0 Karma

Splunk Employee
Splunk Employee

chandana204,

The Splunk web interface shown at startup is typically the AWS EC2 instance Private DNS or internal IP address. You will want to use the public DNS or public IP address for the EC2 instance. You can get that information on the description tab for the EC2 instance within the AWS console.

Also, check the AWS security group associated with your EC2 instance and make sure that there is an inbound TCP rule for port 8000.

Path Finder

I am using Private DNS as web server link. Port 8000 is opened in EC2 Security group.

0 Karma

Splunk Employee
Splunk Employee

You'll need to use the public DNS or public IP address for the EC2 Instance when accessing the Splunk Web UI. As I mentioned above, You can get that information on the description tab for the EC2 instance within the AWS console.

You don't have to do anything with your existing Splunk installation. For some reason when Splunk starts up it always seems to reference the AWS EC2 instance Private DNS entry.

0 Karma

Path Finder

It's working with public DNS.

Thanks,
Chandana

0 Karma

New Member

Have you opened port 8000 in your security groups for the EC2 instance?

0 Karma

Path Finder

Port 8000 is opened in my EC2 instance security group.

0 Karma