I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.
However I am unable to to connect to splunkweb.
I am running under a trial license.
I have changed the default admin password.
As per the "What's Splunk Web" page, I have added
[general]
allowRemoteLogin = always
to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as
$SPLUNK_HOME/etc/system/local/server.conf (which did exist)
I have confirmed the splunkweb python task is running.
'splunk show web-port' shows Web-port: 8000
lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).
Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).
splunkd_access.log shows for each access:
127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms
- The web_service.log does not show any errors.
- I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)
Any ideas? I'm certain it's one of those late Friday night d'oh's.
Thanks,
bk
