Getting Data In

Access splunk manager from a public URL

robvolk
New Member

I have splunk hosted on a win2k machine with IIS7.5 running. How do I configure splunk so I can access it from my local machine via a public URL, i.e. http://splunk.mydomain.com?

Tags (1)
0 Karma
1 Solution

mctester
Communicator

Splunk doesn't use IIS or any other packaged web services, it has it's own, self contained web-service that doesn't rely on any external programs/resources.

To provide access on a public URL, you need to map that URL to the public IP address and port of the SplunkWeb service running on your machine. When Splunk is running, it can usually be accessed at http://localhost:8000 from the local machine, or http://servername:8000 and http://10.0.0.1:8000 from a remote machine, assuming that 10.0.0.1 is your machines IP address - obviously your real IP will be different, this is just an example.

The steps to map the public URL to your machine will depend on your ISP, DNS provider, firewalls etc, so I can't give you those here. However, if you're familiar with how to do this for a regular IIS website, then the process shouldn't be very different. Bear in mind that the default port for an IIS service is 80, while Splunk uses 8000.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

As mctester was saying, Splunk has it's own webserver (splunkweb). There's no NEED for an additional HTTP server. Splunkweb can even do HTTPS if your require it.

You can always just stop IIS altogether (if you're not using it for other things - though I'd recommend NOT running IIS on your Splunk indexer or vice-versa) and set up SplunkWeb to use port 80.

Add / edit $SPLUNK_HOME/etc/system/local/web.conf and put in

[settings]
httpport = 80

All of mctester's above comments about DNS and such still apply.

0 Karma

robvolk
New Member

thanks.. I already have IIS running on that box so I'll go with the port route, but it's good to know that it's an option if I had Splunk on its own server.

0 Karma

mctester
Communicator

Splunk doesn't use IIS or any other packaged web services, it has it's own, self contained web-service that doesn't rely on any external programs/resources.

To provide access on a public URL, you need to map that URL to the public IP address and port of the SplunkWeb service running on your machine. When Splunk is running, it can usually be accessed at http://localhost:8000 from the local machine, or http://servername:8000 and http://10.0.0.1:8000 from a remote machine, assuming that 10.0.0.1 is your machines IP address - obviously your real IP will be different, this is just an example.

The steps to map the public URL to your machine will depend on your ISP, DNS provider, firewalls etc, so I can't give you those here. However, if you're familiar with how to do this for a regular IIS website, then the process shouldn't be very different. Bear in mind that the default port for an IIS service is 80, while Splunk uses 8000.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can also use ARR with IIS 7.5 (although is that right? I thought that IIS 7.5 required Win2008, not Win2k) and set up a reverse proxy to SplunkWeb.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...