I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.
However I am unable to to connect to splunkweb.
I am running under a trial license.
I have changed the default admin password.
As per the "What's Splunk Web" page, I have added
[general]
allowRemoteLogin = always
to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as
$SPLUNK_HOME/etc/system/local/server.conf (which did exist)
I have confirmed the splunkweb python task is running.
'splunk show web-port' shows Web-port: 8000
lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).
Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).
splunkd_access.log shows for each access:
127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms
The web_service.log does not show any errors.
I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)
Any ideas? I'm certain it's one of those late Friday night d'oh's.
Thanks,
bk
... View more