Getting Data In

Access splunk manager from a public URL

robvolk
New Member

I have splunk hosted on a win2k machine with IIS7.5 running. How do I configure splunk so I can access it from my local machine via a public URL, i.e. http://splunk.mydomain.com?

Tags (1)
0 Karma
1 Solution

mctester
Communicator

Splunk doesn't use IIS or any other packaged web services, it has it's own, self contained web-service that doesn't rely on any external programs/resources.

To provide access on a public URL, you need to map that URL to the public IP address and port of the SplunkWeb service running on your machine. When Splunk is running, it can usually be accessed at http://localhost:8000 from the local machine, or http://servername:8000 and http://10.0.0.1:8000 from a remote machine, assuming that 10.0.0.1 is your machines IP address - obviously your real IP will be different, this is just an example.

The steps to map the public URL to your machine will depend on your ISP, DNS provider, firewalls etc, so I can't give you those here. However, if you're familiar with how to do this for a regular IIS website, then the process shouldn't be very different. Bear in mind that the default port for an IIS service is 80, while Splunk uses 8000.

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

As mctester was saying, Splunk has it's own webserver (splunkweb). There's no NEED for an additional HTTP server. Splunkweb can even do HTTPS if your require it.

You can always just stop IIS altogether (if you're not using it for other things - though I'd recommend NOT running IIS on your Splunk indexer or vice-versa) and set up SplunkWeb to use port 80.

Add / edit $SPLUNK_HOME/etc/system/local/web.conf and put in

[settings]
httpport = 80

All of mctester's above comments about DNS and such still apply.

0 Karma

robvolk
New Member

thanks.. I already have IIS running on that box so I'll go with the port route, but it's good to know that it's an option if I had Splunk on its own server.

0 Karma

mctester
Communicator

Splunk doesn't use IIS or any other packaged web services, it has it's own, self contained web-service that doesn't rely on any external programs/resources.

To provide access on a public URL, you need to map that URL to the public IP address and port of the SplunkWeb service running on your machine. When Splunk is running, it can usually be accessed at http://localhost:8000 from the local machine, or http://servername:8000 and http://10.0.0.1:8000 from a remote machine, assuming that 10.0.0.1 is your machines IP address - obviously your real IP will be different, this is just an example.

The steps to map the public URL to your machine will depend on your ISP, DNS provider, firewalls etc, so I can't give you those here. However, if you're familiar with how to do this for a regular IIS website, then the process shouldn't be very different. Bear in mind that the default port for an IIS service is 80, while Splunk uses 8000.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can also use ARR with IIS 7.5 (although is that right? I thought that IIS 7.5 required Win2008, not Win2k) and set up a reverse proxy to SplunkWeb.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...