Hi Splunk Community, I know this question has been asked a several times over. But I don't find a desirable solution to this. We have been installing Splunk Enterprise on various virtual servers each for a Search Head, Indexer, HF. So far we have installed more than 5 Splunk Enterprise on each Linux (RHEL) VM, following the standard installation procedure. Also keeping the splunk.secret file the same throughout. Every server is functioning normally. Except for on one server, we cannot access the splunk web interface via localhost. Note: None of the configurations have been changed. the web.conf file has the startwebserver = 1 and httpport = 8000 The netstat -an | grep 8000 shows that it is listening on this port tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN I have checked if its the firewall issue, with performing a telnet 127.0.0.1 8000, as well as telnet 0.0.0.0 8000 and it gets connected Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'. So I believe that there is no firewall issue as well. The only valuable info I receive on using the "Escape character" after the telnet connection is HTTP/1.1 400 Bad Request
Date: Mon, 12 Oct 2020 16:44:47 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Length: 207
Connection: Close
X-Frame-Options: SAMEORIGIN
Server: Splunkd
<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>HTTP Request was malformed.</p></body></html>
Connection closed by foreign host. I can't seem to find anything on the splunkd.log too. I'm running out of options on how to debug this issue as to why the web server is not loading. Please assist. Thanks,
... View more
