Security

Why am I unable to connect to a Splunk server from a different domain?

nk-1
Path Finder

Trying to connect to a Splunk 6.5 server in domain D1 from domain D2.

Within domain D1,
works: http://hostnameXXX.org:8000

From domain D2,

  1. fails: http://hostnameXXX.org:8000
    ("The connection was reset. The connection to the server was reset while the page was loading.")

  2. works: http://hostnameXXX.org:80
    (MS IIS home page)

  3. works: telnet hostnameXXX.org 8000
    (so port is open and visible)

What could be the problem?
Any other port that needs to be opened?

0 Karma

woodcock
Esteemed Legend

Disable the firewall running on the host and see if it works then.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Do you have a proxy server configured within your browser? A proxy might block the connection from your browser if it's not in some kind of bypass list...?

Perhaps test with firefox/chrome or change your browser settings to disable the proxy, this should force your browser to act the same as telnet (direct connection).

0 Karma

nk-1
Path Finder

I configured Splunk to use port 8080, and the Splunk web-interface works fine now from the other domain.
Something about port 8000...

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...