Security

"Server Error" for a fresh Splunk install

rahgovin
Explorer

Installed a 7.2.4.2 instance on a new Ubuntu Server 18.0.4 VM . The installation went through ok and I set the admin username and password. I run into an issue once the splunk service is started. When I go to the web login page and use the newly created account, I get a "Server Error" message at the bottom of the screen.

I tried the same install on an Ubuntu Desktop version with the same results as above. But then go to the web url using the http:127.0.0.1:8000 and the login works correctly. I change the setting to SSL and now I can login from my remote machine.

I see the same behavior on Centos as well. Anyone seen this before? What logs can I look at to give me some more info on what 's causing the error?

Thanks.

alt text

Tags (2)
1 Solution

vytakas
Engager

In may case it was Bidefender online threat prevention what blocked connection without notification: "An attempt to send your password unencrypted was about to occur on 192.168.xx.xx:8000. We blocked the connection to stop your private data from being exposed and tampered with" Need to add exeption.,In my case it was Bitdefender firewal what bloked conn without any notification: "An attempt to send your password unencrypted was about to occur on 192.168.xxx:8000. We blocked the connection to stop your private data from being exposed and tampered with.
Add to exceptions"

View solution in original post

rahgovin
Explorer

@vytakas : Thank you sir. This is exactly what was blocking the connection to the Splunk server.

0 Karma

vytakas
Engager

In may case it was Bidefender online threat prevention what blocked connection without notification: "An attempt to send your password unencrypted was about to occur on 192.168.xx.xx:8000. We blocked the connection to stop your private data from being exposed and tampered with" Need to add exeption.,In my case it was Bitdefender firewal what bloked conn without any notification: "An attempt to send your password unencrypted was about to occur on 192.168.xxx:8000. We blocked the connection to stop your private data from being exposed and tampered with.
Add to exceptions"

clhall1
Explorer

Exact same issue for; BitDefender

0 Karma

rahgovin
Explorer

After trial and error, I now feel that there is something in the path between my remote computer and the splunk web that is obfuscating the login request. When I send the initial login request un-encrypted on http port 8000, I see the "Server Error" warning. As soon as I enable https, I can login from the same machine without issues. Since the https page sends the login encrypted, whatever is in the path can no longer mess with it. I have not checked my IPS and Firewall logs yet, but pretty sure that one of them is causing the issue. I tried the remote login from another remote machine that bypasses them and can now login without https enabled.

Planning to check the log and capture to see what the splunk side sees. Thanks everyone.

0 Karma

MoniM
Communicator

Hi @rahgovin ,
You can try some below workarounds:-
1. Please look at splunkd.log file (located at $SPLUNK_HOME/var/log/splunk) for errors or warnings.
2. Check for the management port mgmtHostPort = IP:port in your web.conf.
3. You can also clear the cache in SplunkWeb by calling the bump endpoint. https://mysplunkinstall/en-US/_bump(replace mysplunkinstall with the domain name of your Splunk install).
4. Also, restart splunkd.
5. At last, if nothing works for you can try to reinstall splunk.

Hope it helps!
Thanks

0 Karma

rvany
Communicator

Any errors in the logfiles: splunkd.log, splunkd_access.log, web_service.log, web_access.log - or any other?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...