Splunk Enterprise

restrict to localhost only access

jt1
New Member

I need to restrict my Splunk instance to be only accessible on localhost. To do this, I created a new web.conf file and put it in /opt/splunk/etc/system/local. The file as the following contents:

[settings]

server.socket_host = 127.0.0.1

When I restart splunk, I get the following:

Waiting for web server at http://[random char]:8000 to be available...........

Rather than seeing 127.0.0.1, I see random characters. It just sits there.

What am I missing in the config file?

 

Labels (1)
0 Karma

jt1
New Member

Thanks. There are no special characters. However, I have noticed that the "Waiting for web server at http://[random chars]:8000 to be available..." message does not impact availability on localhost. The message "WARNING: web interface does not seem to be available!" displays. During the entire period that it displays, I can verify that Splunk Web is available at http://localhost:8000.  It seems strange to get a message that the web interface is likely not available while it is still available on localhost. It does, still, achieve the desire effect.

Is this normal system behavior?

A couple additional details: (1) I am running Splunk as root. (2) the web.conf file has rw permissions by root. (3) restarting splunk via "/opt/splunk/bin# ./splunk restart" command. (3) this splunk instance is running everything on a single server. (4) no other conf files have been created or modified other than the web.conf file in the /system/local directory.

 

 

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@jt1 you are correct the with settings , did you check is there a special char in web.conf file??. I have tried with following working fine for both localhost and 127.0.0.1 they are synonyms.

[settings]
server.socket_host = localhost

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...