Security

Splunk Remote Login Issue

Marco
Path Finder

Hello, 

I am running a Splunk Server on a windows VM. A few weeks ago Splunk was ungracefully shut off (Windows Server was rebooted, while  Splunk was running). I was able to get Splunk up and running but, only on my local instance. Now other computers on my network cannot access Splunk. 

  1.  I have checked the fire wall settings and everything is good 
  2.  startwebserver = 1
  3. After restarting Splunk It assures me that Port 8000 is open

In conclusion, I am able to access Splunk within that one computer. But after Splunk was shut down ungracefully, other computers on my network can no longer access Splunk.

Any help would be much appreciated. 

Thank you

Marco

Labels (2)
0 Karma
1 Solution

Marco
Path Finder

@richgalloway I appreciate your response, but for this specific situation our proxy server was the issue.

When the server shutdown unexpectedly something happened with our proxy settings, so we disabled the proxy server and where then able to access our Splunk application outside of our local instance. 

To disable your proxy server: 

  1.  Type the following on the start menu: Configure Proxy Server
  2. Then click the Connections tab
  3. In my case I clicked LAN Settings and unclicked all the boxes.

*Note disabling your proxy server should not be a long term solution(In my opinion) 

Thank you,

Marco

View solution in original post

Marco
Path Finder

@richgalloway I appreciate your response, but for this specific situation our proxy server was the issue.

When the server shutdown unexpectedly something happened with our proxy settings, so we disabled the proxy server and where then able to access our Splunk application outside of our local instance. 

To disable your proxy server: 

  1.  Type the following on the start menu: Configure Proxy Server
  2. Then click the Connections tab
  3. In my case I clicked LAN Settings and unclicked all the boxes.

*Note disabling your proxy server should not be a long term solution(In my opinion) 

Thank you,

Marco

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Sounds like a firewall problem.  Yes, I know you checked that, but is it possible the server was assigned a new IP address after reboot and now doesn't comply with the firewall rules?

---
If this reply helps you, an upvote would be appreciated.
0 Karma