Splunk Enterprise
Highlighted

Unable to access web interface after migrating installation. splunk light 7.2.5.1

Engager

I started with a fresh install of 7.2.5.1 and then did a merge of the files from our old installation. The fresh install was able to present the web interface but the after the merge It's not able to connect.
Splunkd.log shows:

10-12-2019 16:43:54.503 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50444 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.625 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50445 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.754 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50446 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The general reponse to these issues are making some updates in server.conf:

sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Which has yielded the sames issue.

Labels (1)
Tags (2)
0 Karma
Highlighted

Re: Unable to access web interface after migrating installation. splunk light 7.2.5.1

Contributor

try enabling webserver, /splunk/bin/splunk enable webserver

0 Karma
Highlighted

Re: Unable to access web interface after migrating installation. splunk light 7.2.5.1

Builder

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues.

My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation.