Splunk® Enterprise

Admin Manual

Download manual as PDF

Download topic as PDF

Use Splunk Web with a reverse proxy configuration

Splunk web can be placed behind a proxy in a reverse proxy type of configuration. If you are hosting Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.

For example if your proxy hosts Splunk Web at "yourhost.com:9000/splunk", root_endpoint should be set to /splunk.

Note: The App Manager is not supported for use with a proxy server, if you use a proxy server with Splunk Web, you must download and update apps manually.

Typical Reverse Proxy Configuration

Lets take an example where Splunk Web is accessed via http://splunk.example.com:8000/lzone instead of http://splunk.example.com:8000/.

For enable this behavior, please set the following in web.conf

root_endpoint=/lzone

For a Apache proxy server, you would then make it visible to the proxy by mapping it in httpd.conf. Please check the documentation for additional information.

# Maps remote servers into the local server URL-space
ProxyPass /lzone http://splunkweb.splunk.com:8000/lzone

#Adjusts the URL in HTTP response headers sent from a reverse proxied server
ProxyPassReverse /lzone http://splunkweb.splunk.com:8000/lzone
PREVIOUS
Best practices when configuring an HTTP Proxy Server for splunkd
  NEXT
About the Splunk Enterprise AMI

This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2


Comments

Modular input with HTTP_PROXY?
If you make your modular input which needs to go through any proxy you have to implement your own proxy codes. HTTP_PROXY is only for the request from SplunkWeb. You can find many sample codes for that in the Internet.

Sylim splunk, Splunker
February 23, 2017

Most corporate proxies require authentication. Can someone add the semantics for that to the docs?

Mlconnor
July 29, 2016

on opensuse 13.1 with splunk 6.3. does not work!
other programs fine.

Alna
November 3, 2015

Running Splunk Lite 6.3 on Ubuntu, still can't get this to work. Tried setting both http_proxy and https_proxy (both upper and lower) in /etc/environment, splunk-launch.conf, and well as adding the environment variable to the init script for splunkd. Environment variable works just fine from command line (wget, etc.) so I can't see what I might be missing.

Briansims
September 29, 2015

This works, however it doesn't indicate whether you can specify a more complicated proxy configuration - like an automatic proxy configuration URL, even with a login/password requirement. That's what a lot of corporate firewalls have now. When Splunk can't get to these external web links, the server essentially locks up and has to be restarted. Is there an option to totally disable the splunk server from going out to the public internet, eliminating the need for a PROXY at all?

Carnone
August 17, 2015

I have added these 2 lines to splunk-launch.conf:<br /><br />HTTP_PROXY=proxy.XXXXX.ca:8080<br />HTTPS_PROXY=proxy.XXXXX.ca:8080<br /><br />and restarted Splunk ( /etc/init.d/splunk restart ). Works like a charm, thanks!

Ontkanin
July 25, 2014

I needed to add to splunk-launch.conf<br /><br />http_proxy=my.server.com:80<br />https_proxy=my.server.com:443<br /><br />The HTTP_PROXY and HTTPS_PROXY did not work. I also needed to reboot the server a simple restart splunk from the webui did not work. I tried this on 3 splunk servers.

Tfiedler
April 1, 2014

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters