"Server Error" for a fresh Splunk install

[rahgovin]

Installed a 7.2.4.2 instance on a new Ubuntu Server 18.0.4 VM . The installation went through ok and I set the admin username and password. I run into an issue once the splunk service is started. When I go to the web login page and use the newly created account, I get a "Server Error" message at the bottom of the screen.

I tried the same install on an Ubuntu Desktop version with the same results as above. But then go to the web url using the http:127.0.0.1:8000 and the login works correctly. I change the setting to SSL and now I can login from my remote machine.

I see the same behavior on Centos as well. Anyone seen this before? What logs can I look at to give me some more info on what 's causing the error?

Thanks.

[rahgovin]

@vytakas : Thank you sir. This is exactly what was blocking the connection to the Splunk server.

[vytakas · Accepted solution]

In may case it was Bidefender online threat prevention what blocked connection without notification: "An attempt to send your password unencrypted was about to occur on 192.168.xx.xx:8000. We blocked the connection to stop your private data from being exposed and tampered with" Need to add exeption.,In my case it was Bitdefender firewal what bloked conn without any notification: "An attempt to send your password unencrypted was about to occur on 192.168.xxx:8000. We blocked the connection to stop your private data from being exposed and tampered with.
Add to exceptions"

[clhall1]

Exact same issue for; BitDefender

[rahgovin]

After trial and error, I now feel that there is something in the path between my remote computer and the splunk web that is obfuscating the login request. When I send the initial login request un-encrypted on http port 8000, I see the "Server Error" warning. As soon as I enable https, I can login from the same machine without issues. Since the https page sends the login encrypted, whatever is in the path can no longer mess with it. I have not checked my IPS and Firewall logs yet, but pretty sure that one of them is causing the issue. I tried the remote login from another remote machine that bypasses them and can now login without https enabled.

Planning to check the log and capture to see what the splunk side sees. Thanks everyone.

[MoniM]

Hi @rahgovin ,
You can try some below workarounds:-
1. Please look at splunkd.log file (located at $SPLUNK_HOME/var/log/splunk) for errors or warnings.
2. Check for the management port mgmtHostPort = IP:port in your web.conf.
3. You can also clear the cache in SplunkWeb by calling the bump endpoint. https://mysplunkinstall/en-US/_bump(replace mysplunkinstall with the domain name of your Splunk install).
4. Also, restart splunkd.
5. At last, if nothing works for you can try to reinstall splunk.

Hope it helps!
Thanks

[rvany]

Any errors in the logfiles: splunkd.log, splunkd_access.log, web_service.log, web_access.log - or any other?