Splunk Web UI is inaccessible

Applicability

Description

- Splunk Web UI is inaccessible. While the backend processes (splunkd and splunkweb) appear to be active.
- Upon navigating to the web interface via http://<IP>:8000  dislays only a blank white screen. 

 

Investigation

1. Verified that both splunkd and splunkweb services were running using:

./splunk status

2. Accessing the Splunk Web UI still resulted in a blank screen.

3. Reviewed #SPLUNKHOME/var/log/splunk/web_service.log and found the following recurring error messages:

2025-02-21 12:15:43,102 ERROR [67b82117127f9844582ad0] startup:116 - Unable to read in product version information; isSessionKeyDefined=True error=[HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/server/info
2025-02-21 12:15:43,102 INFO [67b82117127f9844582ad0] __init__:654 - Authorization Failed: b'<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>Request is not allowed.</p></body></html>\r\n'
2025-02-21 12:15:42,983 ERROR [67b82116cd7f984459bf90] startup:116 - Unable to read in product version information; isSessionKeyDefined=True error=[HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/services/server/info

4. These errors suggest that the internal Splunk web process is attempting to fetch server information via REST API but is being blocked due to authorization failure (HTTP 403).

5. Further inspection revealed a custom configuration is present under  #SPLUNKHOME/etc/system/local/restmap.conf :

[admin:server-info-alias]
acceptFrom = "127.0.0.1"
requireAuthentication = true[admin:server-info]
acceptFrom = "127.0.0.1"
requireAuthentication = true

Resolution

The below steps to be followed to resolve the issue :

1. Remove or rename the custom restmap.conf file from the following directory:

mv $SPLUNK_HOME/etc/system/local/restmap.conf $SPLUNK_HOME/etc/system/local/restmap.conf.bak

2. Restart Splunk to apply the changes:

./splunk restart

After this change, the webUI became accessible again.