Cannot access splunkweb after initial install

[bnklein]

I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.

However I am unable to to connect to splunkweb.

• I am running under a trial license.

• I have changed the default admin password.

• As per the "What's Splunk Web" page, I have added
  [general]
  allowRemoteLogin = always
  to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as
  $SPLUNK_HOME/etc/system/local/server.conf (which did exist)

• I have confirmed the splunkweb python task is running.
  
  'splunk show web-port' shows Web-port: 8000
  lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).

• Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).

• splunkd_access.log shows for each access:

127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms

• The web_service.log does not show any errors.
• I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)

Any ideas? I'm certain it's one of those late Friday night d'oh's.

Thanks,

bk

[dwaddle · Accepted solution]

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

[bnklein]

Like I said, d'oh!

Yes, that was the problem. I am afraid I looked at everything but the most obvious.

Thank you very much.