Security

Why does my Splunk Web only appear when I am not connected to any network?

syx093
Communicator

This is just a curious question, but why is it that Splunk Web only loads when I am not connected to a network or have internet access? It always hangs up when I am connected to a network.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You have a DNS (ownership) issue. Try this command both on/off network:

ping megaman.localdomain.com

It is interesting that I can see a machine there "on the internet":

ping megaman.localdomain.com
Pinging megaman.localdomain.com [98.124.198.1] with 32 bytes of data:
Reply from 98.124.198.1: bytes=32 time=65ms TTL=245

ping megaman.com
Pinging megaman.com [103.224.182.209] with 32 bytes of data:
Reply from 103.224.182.209: bytes=32 time=53ms TTL=55

You should probably be using this URL instead:

https://localhost:8000

View solution in original post

woodcock
Esteemed Legend

You have a DNS (ownership) issue. Try this command both on/off network:

ping megaman.localdomain.com

It is interesting that I can see a machine there "on the internet":

ping megaman.localdomain.com
Pinging megaman.localdomain.com [98.124.198.1] with 32 bytes of data:
Reply from 98.124.198.1: bytes=32 time=65ms TTL=245

ping megaman.com
Pinging megaman.com [103.224.182.209] with 32 bytes of data:
Reply from 103.224.182.209: bytes=32 time=53ms TTL=55

You should probably be using this URL instead:

https://localhost:8000

syx093
Communicator

I have no idea why, but for some weird reason https://megaman:8000 works. Why is that? When I start up splunk it reads splunk web is ready at https://megaman.localdomin:8000 , but will not load. Should I not question it and just roll with it?

0 Karma

woodcock
Esteemed Legend

This is not a production configuration anyway, right (if it was you would be using a more specific FQDN)? So just roll with it, IMHO.

0 Karma

syx093
Communicator

Okay, rolling with it I shall.

0 Karma

jnussbaum_splun
Splunk Employee
Splunk Employee

How are you connecting into Splunk Web, localhost / 127.0.0.1 ? or a name?

0 Karma

syx093
Communicator

I am using a name. megaman.localdomain

full url is
https://megaman.localdomain:8000

0 Karma

jnussbaum_splun
Splunk Employee
Splunk Employee

Interesting. It sounds like perhaps you're running into a DNS resolve issue when connected to a network. Which could be your "nsswitch" config or equiv depending on what OS you're on.

Can you connect to Splunk Web via 127.0.0.1 when you're connected to a network? If so - this would start to point a finger at name resolution. What does megaman.localdomain resolve to on and off the network? (if public IP please mask).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...