Deployment Architecture

Cannot access splunkweb after initial install

bnklein
Engager

I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.

However I am unable to to connect to splunkweb.

  • I am running under a trial license.

  • I have changed the default admin password.

  • As per the "What's Splunk Web" page, I have added
    [general]
    allowRemoteLogin = always
    to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as
    $SPLUNK_HOME/etc/system/local/server.conf (which did exist)

  • I have confirmed the splunkweb python task is running.

    'splunk show web-port' shows Web-port: 8000
    lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).

  • Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).

  • splunkd_access.log shows for each access:

127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms

  • The web_service.log does not show any errors.
  • I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)

Any ideas? I'm certain it's one of those late Friday night d'oh's.

Thanks,

bk

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

bnklein
Engager

Like I said, d'oh!

Yes, that was the problem. I am afraid I looked at everything but the most obvious.

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...