Splunk Search

Connect Splunk to the Internet to retrieve apps

jrsanders
Path Finder

Hello,

I'm tying to add more apps to our Splunk Web GUI. Every time I click "Find More Apps" I get an error message saying "Splunk is unable to connect to the Internet to find more apps." We are running Splunk on Centos 6.5 and I'm not sure what to do. I'm fairly new to using both *nix and Splunk so any help would be appreciated.

Thank You
JS

Tags (3)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

It seems that your Splunk server cannot reach the internet. Check that with your network team. If direct connection to the internet is forbidden in your organization, you can download the apps to your workstation and transfer them from there to your Splunk installation. Then, in the GUI, you choose "install from file" instead.

Hope this helps,

K

View solution in original post

mstegmueller
Explorer

you could also ask them if there is a proxy, that you could use. if thats the case, just go to the cli on your splunkserver and add the env variables:
HTTP_PROXY=proxy:3128
HTTPS_PROXY=proxy:3128

add these to the /etc/bash.bashrc. after restarting splunk it should be able to connect.

kristian_kolb
Ultra Champion

It seems that your Splunk server cannot reach the internet. Check that with your network team. If direct connection to the internet is forbidden in your organization, you can download the apps to your workstation and transfer them from there to your Splunk installation. Then, in the GUI, you choose "install from file" instead.

Hope this helps,

K

jrsanders
Path Finder

Thank you all! This is a huge help 🙂

0 Karma

mkinsley_splunk
Splunk Employee
Splunk Employee

You can find this information directly in the config files . Here is the stanza from server.conf that lists the update servers

[applicationsManagement]
allowInternetAccess = true
url = https://splunkbase.splunk.com/api/apps
loginUrl = https://splunkbase.splunk.com/api/account:login/
detailsUrl = https://splunkbase.splunk.com/apps/id
updateHost = https://splunkbase.splunk.com
updatePath = /api/apps:resolve/checkforupgrade
updateTimeout = 24h

0 Karma

kristian_kolb
Ultra Champion

That seems likely - or perhaps apps.splunk.com.... aah, yes.. that resolves to the same IP.

The firewall guys should be able to pull the blocked connection out of their logs. Or - if you are already splunking them - you can do it yourself!

/K

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I see Splunk resolve splunkbase.splunk.com before accessing online apps, so that's where it's connecting to.

0 Karma

jrsanders
Path Finder

Thank you for the response. They told me its a firewall issue. They asked me where the Web GUI is trying to connect to to get the apps. Not really sure how to answer their question.

0 Karma

tp92222
Explorer

i am facing same problem. can you please tell me what exactly you did to solve this problem .it will be really great help for me.

thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...