Splunk Enterprise

Unable to access web interface after migrating installation. splunk light 7.2.5.1

drossi_dev
Engager

I started with a fresh install of 7.2.5.1 and then did a merge of the files from our old installation. The fresh install was able to present the web interface but the after the merge It's not able to connect.
Splunkd.log shows:

10-12-2019 16:43:54.503 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50444 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.625 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50445 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.754 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50446 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The general reponse to these issues are making some updates in server.conf:

sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Which has yielded the sames issue.

Labels (1)
Tags (2)
0 Karma

ivanreis
Builder

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues.

My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation.

pruthvikrishnap
Contributor

try enabling webserver, /splunk/bin/splunk enable webserver

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...