Deployment Architecture

Cannot access splunkweb after initial install


I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.

However I am unable to to connect to splunkweb.

  • I am running under a trial license.

  • I have changed the default admin password.

  • As per the "What's Splunk Web" page, I have added
    allowRemoteLogin = always
    to $SPLUNKHOME/etc/local/server.conf (which did not exist) as well as
    HOME/etc/system/local/server.conf (which did exist)

  • I have confirmed the splunkweb python task is running.

    'splunk show web-port' shows Web-port: 8000
    lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).

  • Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).

  • splunkd_access.log shows for each access: - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms

  • The web_service.log does not show any errors.
  • I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)

Any ideas? I'm certain it's one of those late Friday night d'oh's.



Tags (3)

Re: Cannot access splunkweb after initial install


Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

View solution in original post


Re: Cannot access splunkweb after initial install


Like I said, d'oh!

Yes, that was the problem. I am afraid I looked at everything but the most obvious.

Thank you very much.

0 Karma