Splunk Dev

Unable to access Rest API over http in splunk 7.1

kvswathi
Path Finder

Hi ,

I am using the splunk latest version 7.1 . Not able to access the splunk rest API using http even after changing the
enableSplunkdSSL = false in server.conf.

It was working well with previous version of splunk. Any idea about the issue ?

-Swathi kv

Tags (1)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

Yeah, that's the default response when you try to speak HTTP to an HTTPS port, therefore it seems to not have worked.

Did you try splunk btool server list sslConfig to see if your config actually works out, or splunk show config server to check the running config of that instance?

If all of this is true and fine, I'd report it to support as a bug.

Besides all of that: You know disabling SSL is considered against best practice and insecure, as you send all your Splunk internal communication over that port, and therefore disabling encryption is not recommended?

View solution in original post

0 Karma

xpac
SplunkTrust
SplunkTrust

Yeah, that's the default response when you try to speak HTTP to an HTTPS port, therefore it seems to not have worked.

Did you try splunk btool server list sslConfig to see if your config actually works out, or splunk show config server to check the running config of that instance?

If all of this is true and fine, I'd report it to support as a bug.

Besides all of that: You know disabling SSL is considered against best practice and insecure, as you send all your Splunk internal communication over that port, and therefore disabling encryption is not recommended?

0 Karma

kvswathi
Path Finder

That was my mistake . I had missed to mention the stanza
[sslConfig] before enableSplunkdSSL = false. Thank you so much for your help.

0 Karma

kvswathi
Path Finder

Thanks for your reply.

The url I am trying to access is http://10.X.X.X:8089

The same is working fine with https://10.X.X.X:8089 . But I need it to work on http.

The response I am getting is

This page isn’t working
10.X.X.X didn’t send any data.
ERR_EMPTY_RESPONSE

-Swathi

0 Karma

xpac
SplunkTrust
SplunkTrust

Can you elaborate on "not able to access"? Do you get a timeout? A connection reset? A HTTP error?
Can you also show the actual URL you're trying to access?

0 Karma

kvswathi
Path Finder

Thanks for your reply.

The url I am trying to access is http://10.X.X.X:8089

The same is working fine with https://10.X.X.X:8089 . But I need it to work on http.

The response I am getting is

This page isn’t working
10.X.X.X didn’t send any data.
ERR_EMPTY_RESPONSE

-Swathi

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...