Deployment Architecture

Splunk Enterprise 8.0 and Ubuntu 18.04 - can't access the UI

rwellum
Explorer

I have successfully installed Splunk Enterprise on Ubuntu 18.04. But I can't access the UI at all.

Splunk is running:

splunk@rich-splunk-ubuntu:~$ splunk status
splunkd is running (PID: 3561).
splunk helpers are running (PIDs: 3562 3575 3713 3773).

Splunk is listening on port 8000:

splunk@rich-splunk-ubuntu:~$ netstat -tulnp | grep 8000
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN 3561/splunkd

Firewall disabled:

splunk@rich-splunk-ubuntu:~$ sudo ufw status
Status: inactive

But connecting to: http://:8000 - tells me cannot be reached. Restarted Splunk and also Ubuntu VM - no change in behavior.

No issues with Centos so far.

0 Karma

tomaszpiekos
Explorer

is it http or https ?

0 Karma

tomaszpiekos
Explorer

do you have local firewall running on Ubuntu ?

0 Karma

rwellum
Explorer

http and I disabled firewall

0 Karma

Richfez
SplunkTrust
SplunkTrust

What tells you that it can't be reached?

Specifically, it's like any other networking problem. You have confirmed that the host has no firewall and that it's listening on the right port.

So either a) you have the wrong network address you are using (All I can see is 'http://:8000' which is completely wrong but I assume just eaten by the editor?), or b) there's an external firewall, or c) the box you are using to access it can't make a connection to it, or ... so on.

What is the server's IP address? What is your workstation's IP? Can you use the workstation to connect to the server via SSH?

If you can via ssh but not via http, then it's network between the two or could be a local firewall on the workstation.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!