well splunk has no way of knowing whether iptables is letting anything through. It really does sound like you havent opened port 8000. Some ways to confirm: If you look in $SPLUNK_HOME/var/log/splunk/web_service.log and there's no errors, and you look in $SPLUNK_HOME/var/log/splunk/web_access.log and there's no sign of anyone trying to hit the /login page, then nothing's getting through.
