Splunk Enterprise

splunk always starts at 127.0.0.1:8000

crazyeva
Contributor

I have a problem
Splunk always start at http://127.0.0.1:8000 and ignor the interface IP address
it is newly installed in a virtual machine, RHEL 7, IP is set as 192.168.100.1
i access the machine with SSH, i mean the interface is alive, can be access to remotely
but it seems SPLUNK can not recognise it

Tags (2)
0 Karma
1 Solution

kml_uvce
Builder

check if you can telnet in port 8000 and 8089 from remote machine if not then these ports are blocked/not accessible.un-block them

View solution in original post

stuxnet23
New Member

Was there a solution for this at the end ? I'm having the same issue.. Splunk is only binding to locahost

0 Karma

stuxnet23
New Member

I found the issue.. It was with permissions.. I kept executing the restart command under root
As soon as I changed user it worked

0 Karma

ithangasamy_spl
Splunk Employee
Splunk Employee

you can use the SPLUNK_BINDIP to start splunkd on a specific port
export SPLUNK_BINDIP=your-ip-addr
do a splunk start
you should see the splunk services binding to only the above IP
to make it permanent put this in etc/splunk-launch.conf

0 Karma

crazyeva
Contributor

thank you for helping
Splunk does start with the ip SPLUNK_BINDIP specified, but i still cant not access to splunk web through ip-addr:8000
after started, ip-addr:8089 ip-addr:8000 are listening, but can not telnet in from outside.

0 Karma

kml_uvce
Builder

check if you can telnet in port 8000 and 8089 from remote machine if not then these ports are blocked/not accessible.un-block them

crazyeva
Contributor

thank you very much
that is my fault: firewall !
RHEL 7, "iptables off" is not effictive...
"systemctl disable firewalld" to shutdown firewall
By the way, splunk 6.2 does not support IE 11 !

0 Karma

crazyeva
Contributor

thank you
i cant telnet in either port,

i changed web port and splunkd port to 80 89, still get this:

Checking prerequisites...
Checking http port [80]: open
Checking mgmt port [89]: open
Checking appserver port [127.0.0.1:8065]: open
Checking kvstore port [8191]: open
Checking configuration... Done.
Checking critical directories... Done
Checking indexes...
Validated: _audit _blocksignature _internal _introspection _thefishbucket history main summary
Done
Checking filesystem compatibility... Done
Checking conf files for problems...
Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Done
[ OK ]

Waiting for web server at http://127.0.0.1:80 to be available... Done

........telnet ip-addr:22 successful

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...