Good afternoon,

I'm trying to get a Splunk instance setup to be accessed from outside the firewall it is NAT'd behind. Currently, I have the port forwarding rule in for 8000->8000. I can access the Splunk login page from outside the firewall, but when I put my credentials in it just reloads the login page.

I have checked the Splunk access.log, and it says user=admin, action=login attempt, info=succeeded.

I also tried forwarding the REST API port (8089), and that hasn't helped. I also found the "allowRemoteLogin" setting in server.conf, and set it to always, but that also did not help. Is there anything I'm missing here? I'm not the most familiar with Splunk, so it might be staring me in the face, but I've tried Googling for a while and haven't found an answer. Thanks for the help!

  • a) look at your firewall logs for denies, b) try it inside the network and check it work. – Chopper3 May 1 '18 at 13:24
  • a) I grep'd the filter log, and found nothing relating to my remote IP address or the internal splunk address. b) I am able to login and use splunk normally from within the network. – Caleb1994 May 1 '18 at 14:58

I was able to solve this problem. The time on the Splunk server was off by 4 hours. This was apparently causing some sort of session invalidation whenever I logged it. I fixed the time, and I'm now able to log in remotely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.