Splunk Enterprise Security

After Enterprise Security Update I get connection reset by peer

andresito123
Communicator

I upgraded to the latest ES app and now I get "The connection was reset" error when I am trying to connect to the web interface.

0 Karma

LukeMurphey
Champion

SplunkWeb likely was not able to start.

This is likely due to old advanced XML modules being left around. Delete the directory $SPLUNK_HOME/etc/apps/SA-Utils/appserver/modules/SOLNLookupEditor and restart SplunkWeb.

See https://answers.splunk.com/answers/620634/why-wont-splunkweb-start-after-es-was-upgraded.html for more details.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...