Splunk Enterprise

Unable to access web interface after migrating installation. splunk light 7.2.5.1

drossi_dev
Engager

I started with a fresh install of 7.2.5.1 and then did a merge of the files from our old installation. The fresh install was able to present the web interface but the after the merge It's not able to connect.
Splunkd.log shows:

10-12-2019 16:43:54.503 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50444 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.625 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50445 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.754 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50446 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The general reponse to these issues are making some updates in server.conf:

sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Which has yielded the sames issue.

Labels (1)
Tags (2)
0 Karma

ivanreis
Builder

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues.

My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation.

pruthvikrishnap
Contributor

try enabling webserver, /splunk/bin/splunk enable webserver

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...