Security

Why does my Splunk Web only appear when I am not connected to any network?

Communicator

This is just a curious question, but why is it that Splunk Web only loads when I am not connected to a network or have internet access? It always hangs up when I am connected to a network.

Tags (2)
0 Karma
1 Solution

Esteemed Legend

You have a DNS (ownership) issue. Try this command both on/off network:

ping megaman.localdomain.com

It is interesting that I can see a machine there "on the internet":

ping megaman.localdomain.com
Pinging megaman.localdomain.com [98.124.198.1] with 32 bytes of data:
Reply from 98.124.198.1: bytes=32 time=65ms TTL=245

ping megaman.com
Pinging megaman.com [103.224.182.209] with 32 bytes of data:
Reply from 103.224.182.209: bytes=32 time=53ms TTL=55

You should probably be using this URL instead:

https://localhost:8000

View solution in original post

Esteemed Legend

You have a DNS (ownership) issue. Try this command both on/off network:

ping megaman.localdomain.com

It is interesting that I can see a machine there "on the internet":

ping megaman.localdomain.com
Pinging megaman.localdomain.com [98.124.198.1] with 32 bytes of data:
Reply from 98.124.198.1: bytes=32 time=65ms TTL=245

ping megaman.com
Pinging megaman.com [103.224.182.209] with 32 bytes of data:
Reply from 103.224.182.209: bytes=32 time=53ms TTL=55

You should probably be using this URL instead:

https://localhost:8000

View solution in original post

Communicator

I have no idea why, but for some weird reason https://megaman:8000 works. Why is that? When I start up splunk it reads splunk web is ready at https://megaman.localdomin:8000 , but will not load. Should I not question it and just roll with it?

0 Karma

Esteemed Legend

This is not a production configuration anyway, right (if it was you would be using a more specific FQDN)? So just roll with it, IMHO.

0 Karma

Communicator

Okay, rolling with it I shall.

0 Karma

Splunk Employee
Splunk Employee

How are you connecting into Splunk Web, localhost / 127.0.0.1 ? or a name?

0 Karma

Communicator

I am using a name. megaman.localdomain

full url is
https://megaman.localdomain:8000

0 Karma

Splunk Employee
Splunk Employee

Interesting. It sounds like perhaps you're running into a DNS resolve issue when connected to a network. Which could be your "nsswitch" config or equiv depending on what OS you're on.

Can you connect to Splunk Web via 127.0.0.1 when you're connected to a network? If so - this would start to point a finger at name resolution. What does megaman.localdomain resolve to on and off the network? (if public IP please mask).