Deployment Architecture

Cannot access splunkweb after initial install

bnklein
Engager

I am new to Splunk and just installed splunk-4.2.4-110225-linux-2.6-x86_64.rpm on Red Hat Linux Enterprise 6. The installation went fine with no noted errors.

However I am unable to to connect to splunkweb.

  • I am running under a trial license.

  • I have changed the default admin password.

  • As per the "What's Splunk Web" page, I have added
    [general]
    allowRemoteLogin = always
    to $SPLUNK_HOME/etc/local/server.conf (which did not exist) as well as
    $SPLUNK_HOME/etc/system/local/server.conf (which did exist)

  • I have confirmed the splunkweb python task is running.

    'splunk show web-port' shows Web-port: 8000
    lsof -i tcp:8000 shows irdmi running on tcp/8000. (Red Hat's /etc/services used for displaying network services shows irdmi running on tcp/8000).

  • Just to make certain there was no conflict I changed splunkweb's port to 8080 and restarted splunk. A subsequent show web-port and lsof confirm python is listening on tcp/8080 even though I cannot connect to it. (It's not a network connectivity issue; I can ping the server from the client, and the client from the server).

  • splunkd_access.log shows for each access:

127.0.0.1 - splunk-system-user [09/Dec/2011:19:05:29.674 -0600] "POST /servicesNS/nobody/search/saved/searches/Top%20five%20sourcetypes/notify?trigger.condition_state=1 HTTP/1.0" 200 2089 - - - 9ms

  • The web_service.log does not show any errors.
  • I have confirmed that all files are owned by splunk and there are no errors when I restart. I have tried running under the splunk logonid as well as root (only for testing)

Any ideas? I'm certain it's one of those late Friday night d'oh's.

Thanks,

bk

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Did you either disable the RHEL iptables firewall, or add the Splunkweb ports to the firewall's allow list?

bnklein
Engager

Like I said, d'oh!

Yes, that was the problem. I am afraid I looked at everything but the most obvious.

Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...