Splunk Enterprise

Unable to access web interface after migrating installation. splunk light 7.2.5.1

drossi_dev
Engager

I started with a fresh install of 7.2.5.1 and then did a merge of the files from our old installation. The fresh install was able to present the web interface but the after the merge It's not able to connect.
Splunkd.log shows:

10-12-2019 16:43:54.503 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50444 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.625 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50445 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
10-12-2019 16:43:54.754 +0000 WARN  HttpListener - Socket error from 127.0.0.1:50446 while idling: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

The general reponse to these issues are making some updates in server.conf:

sslVersions = *,-ssl2
sslVersionsForClient = *,-ssl2
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

Which has yielded the sames issue.

Labels (1)
Tags (2)
0 Karma

ivanreis
Builder

When you copy over the old config files from your previous installation to the new one, splunk run a verification if the files are running on a different version and did not start the web, I am not really sure which files splunk uses to check it. The web is a very sensitive part of Splunk and you should be very carefully when you have to restore any config file from previous Splunk versions, because it is very hard to recover the Splunk web from the times I ran into issues.

My suggestion to fix it, please reinstall the last Splunk Enterprise version, because it will be recover the web interface. Be carefully if you have to restore any file from previous installation and avoid to copy the entire folder, because it can cause the issues again. Copy the config files individually and check if Splunk will working properly. This is a manual process and time consuming, thus is necessary to avoid issues when you are copying the old config files to a new Splunk installation.

pruthvikrishnap
Contributor

try enabling webserver, /splunk/bin/splunk enable webserver

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...