By not using the Splunk sever, how do I get to Web Interface?

[drizzo]

I have an offline network consisting of thirteen machines, one of them being the Splunk server. I wish to use one of the other computers (one of the hosts on the same network) to get the web interface. Those that will be searching the logs via the web interface will not have access to the Splunk server -- so they won't able to simply use http://localhost:8000, obviously.

I'm assuming I'll need to make some sub-accounts maybe. I was just looking for some guidance. Thanks.

[horsefez · Accepted solution]

Hi drizzo,

why don't you just use the webbrowser on your own computer at your desk and type in the following URL:

http://<ip-of-the-server>:8000

example:
http://10.0.4.1:8000

If the server is in the same network and the port 8000 is not blocked by a local firewall everything should work fine.

[drizzo]

Oh my gosh, I can't believe I never thought of that. Thank you so much.

[woodcock]

Don't forget to click Accept to close the question.

[somesoni2]

If you're looking to port just the Splunk web UI component to different server, then it's not possible. If your current server is restricted/behind firewall, then you could setup a F5 VIP so that users login using that VIP URL. You can then just allow connection from F5 to your restricted Splunk server.

[drizzo]

So, I wouldn't be able to login to the Web interface using my own computer at my desk while it is on the same network as the other computer running Splunk Enterprise (acting as the Splunk server)? My computer has the Splunk Forwarder but not the actual Enterprise software.

[woodcock]

This is very unclear to me and probably to others. I don't get it at all.

[drizzo]

The only way I know how to get to the web interface for Splunk is being on the Splunk server itself by typing 'http://localhost:8000' in the address bar.

My question: Is there another way I can get to the web interface by not being on the Splunk server? For example: Can I use one of the other computers on my network to get to the interface?

[horsefez]

Hi,

if you start your server via console splunk will print you the webinterface with the webaddress to the server.

I assume your webaddress will look kinda like that

http://<nameofyourhost>:8000
http://<ipaddressofyourhost>:8000