Splunk Enterprise

restrict to localhost only access

jt1
New Member

I need to restrict my Splunk instance to be only accessible on localhost. To do this, I created a new web.conf file and put it in /opt/splunk/etc/system/local. The file as the following contents:

[settings]

server.socket_host = 127.0.0.1

When I restart splunk, I get the following:

Waiting for web server at http://[random char]:8000 to be available...........

Rather than seeing 127.0.0.1, I see random characters. It just sits there.

What am I missing in the config file?

 

Labels (1)
0 Karma

jt1
New Member

Thanks. There are no special characters. However, I have noticed that the "Waiting for web server at http://[random chars]:8000 to be available..." message does not impact availability on localhost. The message "WARNING: web interface does not seem to be available!" displays. During the entire period that it displays, I can verify that Splunk Web is available at http://localhost:8000.  It seems strange to get a message that the web interface is likely not available while it is still available on localhost. It does, still, achieve the desire effect.

Is this normal system behavior?

A couple additional details: (1) I am running Splunk as root. (2) the web.conf file has rw permissions by root. (3) restarting splunk via "/opt/splunk/bin# ./splunk restart" command. (3) this splunk instance is running everything on a single server. (4) no other conf files have been created or modified other than the web.conf file in the /system/local directory.

 

 

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@jt1 you are correct the with settings , did you check is there a special char in web.conf file??. I have tried with following working fine for both localhost and 127.0.0.1 they are synonyms.

[settings]
server.socket_host = localhost

 

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...