I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.
However I am unable to to connect to splunkweb.
I am running under a trial license.
I have changed the default admin password.
As per the "What's Splunk Web" page, I have added
allowRemoteLogin = always
to $SPLUNKHOME/etc/local/server.conf (which did not exist) as well as
$SPLUNKHOME/etc/system/local/server.conf (which did exist)
I have confirmed the splunkweb python task is running.
'splunk show web-port' shows Web-port: 8000
lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).
Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).
splunkd_access.log shows for each access:
127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms
Any ideas? I'm certain it's one of those late Friday night d'oh's.
Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?
Like I said, d'oh!
Yes, that was the problem. I am afraid I looked at everything but the most obvious.
Thank you very much.