Splunk Enterprise

Unable to access web interface after migrating installation. splunk light 7.2.5.1

drossi_dev
Engager

I started with a fresh install of 7.2.5.1 and then did a merge of the files from our old installation. The fresh install was able to present the web interface but the after the merge It's not able to connect.
Splunkd.log shows:

10-12-2019 16:43:54.503 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50444 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.625 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50445 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.754 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50446 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The general reponse to these issues are making some updates in server.conf:

sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Which has yielded the sames issue.

Labels (1)
Tags (2)
0 Karma

ivanreis
Builder

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues.

My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation.

pruthvikrishnap
Contributor

try enabling webserver, /splunk/bin/splunk enable webserver

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...