Splunk Enterprise Security

Facing problem during configure "Splunk Enterprise Security Suite"

arun_kant_sharm
Path Finder

Hi Experts,

I try to install "Splunk Enterprise Security Suite" in my standalone environment.
For this I follow:
https://docs.splunk.com/Documentation/ES/6.0.0/Install/InstallEnterpriseSecuritySHC

But when I try to follow below step:

Install Enterprise Security on the deployer.
Increase the Splunk Web upload limit, for example to 1GB, by creating a file called $SPLUNK_HOME/etc/system/local/web.conf with the following stanza.
[settings]
max_upload_size = 1000

Then I restart my splunk server, so at the time of restart it give below error
WARNING: web interface does not seem to be available!

Kindly suggest the right guide for installing and configuring "Splunk Enterprise Security Suite".

ndias_splunk
Splunk Employee
Splunk Employee

By chance, did you follow the guide exactly? Did you include the comment in the stanza?

max_upload_size = 1000 // increases SplunkWeb upload limit to 1GB

If so, try removing the comment so the stanza is:

max_upload_size = 1000

Then restart Splunk.

0 Karma

arun_kant_sharm
Path Finder

My Splunk instance are on AWS EC2 using instance type c5.4xlarge

0 Karma

jawaharas
Motivator
  1. What's the output of './splunk btool check' command?
  2. Did you make changes to $SPLUNK_HOME/etc/system/default/web.conf file?
  3. What's are the errors you can see in 'splunkd.log' file?
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...