Bind splunk webserver to a particular URL address (of an Amazon EC2 instance).

[boris]

After I installed Splunk on a (64 AMD debian) Amazon EC2 instance I see this message:

The Splunk web interface is at http://ip-10-12-117-100:8000

The problem is that this IP above 10-12-117-100 is listed by Amazon as the internal or private IP address, so the web service can't be accessed with this IP.

I need Splunk to bind to this public address:

ec2-5X-XX-XXX-XX.compute-1.amazonaws.com

My guess is that there is a configuration file that I need to edit and then I need to restart Splunk?

[csharp_splunk · Accepted solution]

Amazon EC2 does not give you a public address on your instance. Instead, it does destination NAT on the public IP to the private IP when the source attempts to access it. It's transparent to your application. If you attempt to use Splunk on port 8000 from the public IP that EC2 has given you, it will work, assuming you've setup the firewall rules properly.

[ftk]

Correct. I would recommend to force HTTPS for splunkweb as well. To get a friendly URL I recommend setting up DynDNS or similar service.