Installation

Cannot get to Splunk Web interface

DNT
New Member

Hi there

I have installed Splunk on Solaris 10 Sparc machine. On that machine Orca is also running. After installation it gives me the address for my browser but when I paste that in my browser then it is not opening the interface. Is there perhaps a conflict with Apache running on that machine? I've even tried changing the ports but to no avail.

Thanks in advance

Dean

Tags (1)
0 Karma

jony360
New Member

I also facing same issue when i am trying to login Splunk GUI via my user name and password its throwing error "Login Fail" and for other users which are another domain they are able to login successfully only user belong to my AD domain having some issue, I have tried restarting Linux Splunk services check AD bind configuration file but not able to fix the issue. Any idea what goes wrong?
Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Dude! You're piling on to a thread that's 10 years old! Please post a new question.

---
If this reply helps you, an upvote would be appreciated.

neelamssantosh
Contributor

Hope it can help you,

  1. check the port and hostname are right, sometime hostname may not be resolved so use the IP address
    ./splunk show web-port

  2. check startwebserver =1
    ./splunk cmd btool web list --debug |grep startwebserver

  3. Run these commands to open the iptables/ports in Unix machines
    sudo firewall-cmd --zone=public --add-port=8000/tcp --permanent
    sudo firewall-cmd --reload

Hope by now u will be able to access the Webserver.
Happy splunking 🙂

Herman
Explorer

What are the commands for the firewall permission on MacOS? Thanks

0 Karma

rbenlizar
New Member

This was the simple solution that I spent 2 hrs looking for, lol. Thank you

0 Karma

mwhitener
Engager

Oh wow - 8 hours gone and then find this answer and it is all clear now. Thank you so much!

0 Karma

khushsingh
Engager

This is bizarre, I didn't have to do this in any other instant of Splunk, they all worked,

So wasn't sure this was the right answer. then carried on troubleshooting.
2 days later...thought lets open this port ..and Volla !

Thanks...

0 Karma

Sahithi0394
New Member

doesn't make any change in my server.

0 Karma

pratibha2018
Explorer

What if startwebserver =0 ?
What should I need to do as splunk Daemon is running?

0 Karma

jalfrey
Communicator

by default CentOS 6.4 has IPTables enabled. This blocks port 8000 access. To turn it off do the following:

/etc/init.d/iptables save
/etc/init.d/iptables stop

to prevent it from coming back on next boot

chkconfig iptables off

williamche
Path Finder

Hope your Splunk is accessible now after changing your firewall's ACL. If not then check if the hostname in the URL that Splunk gave is resolvable. If not then you'll have to use the server's fully qualified domain name.

0 Karma

balbano
Contributor

Yea if the service is running and you cannot telnet to your splunk instance host on port 8000 from your local PC most likely its a Firewall ACL issue.

Brian

0 Karma

chris
Motivator

Maybe this will help you:

What is the output of the following command:

$SPLUNK_HOME/bin/splunk status

It should be something like this:

splunkd is running (PID: 9630).
splunk helpers are running (PIDs: 9631).
splunkweb is running (PID: 9776).

Check the httpport setting in the web.conf file here $SPLUNK_HOME/etc/system/local/

Make sure that something is listening on that port with netstat -an

Check the log file in $SPLUNK_HOME/var/log/splunk/splunkd.log to see if there are any errors

chris
Motivator

Ok, hope this will work:)

0 Karma

DNT
New Member

Correction on my previous comment. The port seems to be blocked. It should work once we allow access.

0 Karma

DNT
New Member

root@host:/splunk/splunk/bin# ./splunk status
splunkd is running (PID: 27525).
splunk helpers are running (PIDs: 27526).
splunkweb is running (PID: 27537).

cat /splunk/splunk/etc/system/local/web.conf
[default]

[settings]
httpport = 8001

The netstat command shows that it is listening on the port 8001. I even changed the port and it had no effect.

I checked the logs and it is mostly just info events. I don't think I'm being blocked on a firewall either because I am able to telnet to the server using the port specified.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!