Installation

Unable to access web UI

fromero
Splunk Employee
Splunk Employee

Hi all, I am new to splunk

When I start splunk, it does not show information regarding the web being available to access.

Normally at the end there is a meesage saying that the web interface is available at 127.0.0.0:8000

I just desapeared because I was able to earlier. I dont know if a misconfigured something

 

fromero_0-1706307621113.png

Appreciate the help

 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

gcusello
SplunkTrust
SplunkTrust

Hi @fromero ,

if you run "your_ip_address:8000" can you access the web GUI of your Splunk server?

If not there could be two issues:

  • as @isoutamo said, the web interfaces could be disabled, if this is your firt installation it's very rare,
  • you didn't disable the local firewall  (iptables).

In the second case disable iptables and try again.

Ciao.

Giuseppe

isoutamo
SplunkTrust
SplunkTrust

Based on screen shot the web server is disabled, so there shouldn’t be anything listening on port 8000. Unless it’s not disabled then you should found reason why it’s not try to start it from splunkd.log.

isoutamo
SplunkTrust
SplunkTrust

Hi

you should check if you have disabled web server. See https://docs.splunk.com/Documentation/Splunk/latest/Security/DisableunnecessarySplunkcomponents

r. Ismo

Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...