Deployment Architecture

Bind splunk webserver to a particular URL address (of an Amazon EC2 instance).

boris
Path Finder

After I installed Splunk on a (64 AMD debian) Amazon EC2 instance I see this message:

The Splunk web interface is at http://ip-10-12-117-100:8000

The problem is that this IP above 10-12-117-100 is listed by Amazon as the internal or private IP address, so the web service can't be accessed with this IP.

I need Splunk to bind to this public address:

ec2-5X-XX-XXX-XX.compute-1.amazonaws.com

My guess is that there is a configuration file that I need to edit and then I need to restart Splunk?

Tags (3)
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

Amazon EC2 does not give you a public address on your instance. Instead, it does destination NAT on the public IP to the private IP when the source attempts to access it. It's transparent to your application. If you attempt to use Splunk on port 8000 from the public IP that EC2 has given you, it will work, assuming you've setup the firewall rules properly.

View solution in original post

csharp_splunk
Splunk Employee
Splunk Employee

Amazon EC2 does not give you a public address on your instance. Instead, it does destination NAT on the public IP to the private IP when the source attempts to access it. It's transparent to your application. If you attempt to use Splunk on port 8000 from the public IP that EC2 has given you, it will work, assuming you've setup the firewall rules properly.

ftk
Motivator

Correct. I would recommend to force HTTPS for splunkweb as well. To get a friendly URL I recommend setting up DynDNS or similar service.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...