Why does my Splunk Web only appear when I am not connected to any network?

[syx093]

This is just a curious question, but why is it that Splunk Web only loads when I am not connected to a network or have internet access? It always hangs up when I am connected to a network.

[woodcock · Accepted solution]

You have a DNS (ownership) issue. Try this command both on/off network:

ping megaman.localdomain.com

It is interesting that I can see a machine there "on the internet":

ping megaman.localdomain.com
Pinging megaman.localdomain.com [98.124.198.1] with 32 bytes of data:
Reply from 98.124.198.1: bytes=32 time=65ms TTL=245

ping megaman.com
Pinging megaman.com [103.224.182.209] with 32 bytes of data:
Reply from 103.224.182.209: bytes=32 time=53ms TTL=55

You should probably be using this URL instead:

https://localhost:8000

[syx093]

I have no idea why, but for some weird reason https://megaman:8000 works. Why is that? When I start up splunk it reads splunk web is ready at https://megaman.localdomin:8000 , but will not load. Should I not question it and just roll with it?

[woodcock]

This is not a production configuration anyway, right (if it was you would be using a more specific FQDN)? So just roll with it, IMHO.

[syx093]

Okay, rolling with it I shall.

[jnussbaum_splun]

How are you connecting into Splunk Web, localhost / 127.0.0.1 ? or a name?

[syx093]

I am using a name. megaman.localdomain

full url is
https://megaman.localdomain:8000

[jnussbaum_splun]

Interesting. It sounds like perhaps you're running into a DNS resolve issue when connected to a network. Which could be your "nsswitch" config or equiv depending on what OS you're on.

Can you connect to Splunk Web via 127.0.0.1 when you're connected to a network? If so - this would start to point a finger at name resolution. What does megaman.localdomain resolve to on and off the network? (if public IP please mask).