Security

Can't connect to http://myserver:8000 on fresh install CentOS7

amanogue
New Member

I've just installed latest splunk on a fresh minimal CentOS 7 installation.

Installation process showed no warnings or errors. Everything seems to be OK. I ran the init script command and i can see both ports (8000 & 8089) listening but I can't connect to splunk's web.

This is the output for "status".

[root@saysplunk ~]# systemctl status splunk
splunk.service - SYSV: Splunk indexer service
Loaded: loaded (/etc/rc.d/init.d/splunk)
Active: active (running) since mié 2015-03-04 13:18:37 CET; 12min ago
Process: 1350 ExecStart=/etc/rc.d/init.d/splunk start (code=exited, status=0/SUCCESS)
CGroup: /system.slice/splunk.service
├─2421 splunkd -p 8089 start
├─2422 [splunkd pid=2421] splunkd -p 8089 start [process-runner]
├─2429 mongod --dbpath=/opt/splunk/var/lib/splunk/kvstore/mongo --port=8191 --timeStampFormat=iso8601-utc --smallfiles --oplogSize=1000 --keyFile=/opt/splunk/var/lib/splunk/kvsto...
├─2486 /opt/splunk/bin/python -O /opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/root.py --proxied=127.0.0.1,8065,8000
└─2509 /opt/splunk/bin/splunkd instrument-resource-usage -p 8089

mar 04 13:18:32 saysplunk splunk[1350]: Checking conf files for problems...
mar 04 13:18:32 saysplunk splunk[1350]: Done
mar 04 13:18:32 saysplunk splunk[1350]: All preliminary checks passed.
mar 04 13:18:32 saysplunk splunk[1350]: Starting splunk server daemon (splunkd)...
mar 04 13:18:32 saysplunk splunk[1350]: Done
mar 04 13:18:37 saysplunk splunk[1350]: Waiting for web server at http://127.0.0.1:8000 to be available...... Done
mar 04 13:18:37 saysplunk splunk[1350]: If you get stuck, we're here to help.
mar 04 13:18:37 saysplunk splunk[1350]: Look for answers here: http://docs.splunk.com
mar 04 13:18:37 saysplunk splunk[1350]: The Splunk web interface is at http://saysplunk:8000
mar 04 13:18:37 saysplunk systemd[1]: Started SYSV: Splunk indexer service.

Can you see something wrong?

Regards
Antonio.

Tags (2)
0 Karma
1 Solution

MuS
Legend

check your local firewall or SELINUX settings

View solution in original post

ephemeric
Contributor

According to the log: your Splunk webserver was listening on loopback only.

If you're connecting from localhost to localhost on 8000 that's okay.

If not:

ncat -v saysplunk 8000
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to <IP>:8000.
0 Karma

MuS
Legend

check your local firewall or SELINUX settings

amanogue
New Member

Thx.

Now CentOS 7 manage conections trough firewalld instead iptables.

Now web interface is working.

0 Karma

joshclarkA
New Member

firewall-cmd --permanent --add-port=8000/tcp

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...