Access splunk manager from a public URL

[robvolk]

I have splunk hosted on a win2k machine with IIS7.5 running. How do I configure splunk so I can access it from my local machine via a public URL, i.e. http://splunk.mydomain.com?

[dwaddle]

As mctester was saying, Splunk has it's own webserver (splunkweb). There's no NEED for an additional HTTP server. Splunkweb can even do HTTPS if your require it.

You can always just stop IIS altogether (if you're not using it for other things - though I'd recommend NOT running IIS on your Splunk indexer or vice-versa) and set up SplunkWeb to use port 80.

Add / edit $SPLUNK_HOME/etc/system/local/web.conf and put in

[settings]
httpport = 80

All of mctester's above comments about DNS and such still apply.

[robvolk]

thanks.. I already have IIS running on that box so I'll go with the port route, but it's good to know that it's an option if I had Splunk on its own server.

[mctester · Accepted solution]

Splunk doesn't use IIS or any other packaged web services, it has it's own, self contained web-service that doesn't rely on any external programs/resources.

To provide access on a public URL, you need to map that URL to the public IP address and port of the SplunkWeb service running on your machine. When Splunk is running, it can usually be accessed at http://localhost:8000 from the local machine, or http://servername:8000 and http://10.0.0.1:8000 from a remote machine, assuming that 10.0.0.1 is your machines IP address - obviously your real IP will be different, this is just an example.

The steps to map the public URL to your machine will depend on your ISP, DNS provider, firewalls etc, so I can't give you those here. However, if you're familiar with how to do this for a regular IIS website, then the process shouldn't be very different. Bear in mind that the default port for an IIS service is 80, while Splunk uses 8000.

[gkanapathy]

You can also use ARR with IIS 7.5 (although is that right? I thought that IIS 7.5 required Win2008, not Win2k) and set up a reverse proxy to SplunkWeb.