Deployment Architecture
Highlighted

Cannot access splunkweb after initial install

Engager

I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.

However I am unable to to connect to splunkweb.

  • I am running under a trial license.

  • I have changed the default admin password.

  • As per the "What's Splunk Web" page, I have added
    [general]
    allowRemoteLogin = always
    to $SPLUNKHOME/etc/local/server.conf (which did not exist) as well as
    $SPLUNK
    HOME/etc/system/local/server.conf (which did exist)

  • I have confirmed the splunkweb python task is running.

    'splunk show web-port' shows Web-port: 8000
    lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).

  • Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).

  • splunkd_access.log shows for each access:

127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms

  • The web_service.log does not show any errors.
  • I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)

Any ideas? I'm certain it's one of those late Friday night d'oh's.

Thanks,

bk

Tags (3)
Highlighted

Re: Cannot access splunkweb after initial install

SplunkTrust
SplunkTrust

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

View solution in original post

Highlighted

Re: Cannot access splunkweb after initial install

Engager

Like I said, d'oh!

Yes, that was the problem. I am afraid I looked at everything but the most obvious.

Thank you very much.

0 Karma