All Apps and Add-ons

No Available Splunk Web Ports on AWS Instance

seandevo
Explorer

I am currently hosting an Amazon Linux OS (EC2) on AWS, which is the same service that Splunk U uses. After sucessfully downloading and installing Splunk as a root user and starting it up for the first time, I changed the IP address of the default IP to the Public IP address AWS EC2 provided by adding the following line to /opt/splunk/etc/splunk-launch.conf:

SPLUNK_BINDIP:111.222.333.444

I also changed the mgmt ip and port under /opt/splunk/etc/system/local/web.conf:

When I tried to ./splunk restart, I get the error message saying: "Checking http port [111.222.333.444:8000]: already bound. ERROR: The HTTP Port [8000] is already bound. Splunk needs to use this port.

Even if I change the Port, it gives me the same error (with the new port number).

I checked "netstat -anp" and there was no port shown to be bound to the instance.

On the AWS side, I configured the security group to allow inbound connetion to TCP 8000, 8089, 80, and 443. Still no luck.

Anyone have advice? Thanks

Best Regards,
Sean Devo, Systems Engineer
pm2NET

0 Karma
1 Solution

seandevo
Explorer

I figured out why the ports were not working. AWS already provides a public IP and public domain name that will work even though the original install of splunk will give it a private IP host.

Long story short, when installing Splunk and starting it up for the first time, your webUI can be accessed with: publicIP:8000 found on your AWS EC2 instance dashboard. No need for 'SPLUNK_BINDIP' command.

View solution in original post

0 Karma

seandevo
Explorer

I figured out why the ports were not working. AWS already provides a public IP and public domain name that will work even though the original install of splunk will give it a private IP host.

Long story short, when installing Splunk and starting it up for the first time, your webUI can be accessed with: publicIP:8000 found on your AWS EC2 instance dashboard. No need for 'SPLUNK_BINDIP' command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...