I just finished a nice clean install in Centos 6.3:
[root@server tmp]# /etc/init.d/splunk start ... snip ... Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking configuration... Done. Checking indexes... Creating: /opt/splunk/var/lib/splunk Creating: /opt/splunk/var/run/splunk Creating: /opt/splunk/var/run/splunk/appserver/i18n Creating: /opt/splunk/var/run/splunk/appserver/modules/static/css Creating: /opt/splunk/var/run/splunk/upload Creating: /opt/splunk/var/spool/splunk Creating: /opt/splunk/var/spool/dirmoncache Creating: /opt/splunk/var/lib/splunk/authDb Creating: /opt/splunk/var/lib/splunk/hashDb Validated databases: _audit _blocksignature _internal _thefishbucket history main summary Done New certs have been generated in '/opt/splunk/etc/auth'. Checking filesystem compatibility... Done Checking conf files for typos... Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Starting splunkweb... Generating certs for splunkweb server Generating a 1024 bit RSA private key ...................................++++++ ...................++++++ writing new private key to 'privKeySecure.pem' ----- Signature ok subject=/CN=server/O=SplunkUser Getting CA Private Key writing RSA key [ OK ] Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at http://server:8000
So that's all looks good. I try with my browser and I get kicked out "Connection timeout"
[root@server tmp]# telnet 10.10.10.249 8000 Trying 10.10.10.249... Connected to 10.10.10.249. Escape character is '^]'. GET / HTTP/1.1 Host: server HTTP/1.1 303 See Other Content-Type: text/html;charset=utf-8 Location: http://server/en-US/ Content-Length: 100 Server: CherryPy/3.1.2 Date: Tue, 05 Mar 2013 13:32:46 GMT Set-Cookie: session_id_8000=d81e90d94a7dcadca73f83118e3ce704ef590989; expires=Wed, 06 Mar 2013 13:32:46 GMT; httponly; Path=/ This resource can be found at http://server/en-US/.Connection closed by foreign host. [root@server tmp]#
What am I doing wrong?
The example you show with telnet suggests no fault. However, testing from the server to itself is not going to establish that your connection is allowed from another system. One presumes that since you are testing from the command line with telnet that you are not using a local browser.
Is the browser you ARE using on the same network segment? Are there intervening firewalls?
Are you running local firewall rules? Have you created an additional rule to allow access to port 8000 from other sources?
Are you running the browser from the same server, or is this your laptop connecting to it remotely? If so, check to make sure the iptables on your system isn't blocking port 8000 from the outside world.
If you use a proxy for your browser, you need to make sure there's exceptions so that it doesn't go out on the internet to get to the address.
Change the browser config to not use a proxy to test this.
Are you seeing any errors in your logs, eg; web_access logs in /opt/splunk/var/log/splunk/ or are you getting no connection to the server at all?
Looks OK to me? You obviously have connectivity so whatever issues you are experiencing sound more like browser related than Splunk related...