Customize proxy settings in sbf.conf

You can customize proxy settings in the sbf.conf file to enable Splunk business Flow (SBF) to use your proxy.

Enable your proxy in sbf.conf

Follow these steps to enable your proxy for Splunk Business Flow. Prerequisites

• Only users with file system access, such as system administrators, can enable SBF to use your proxy using configuration files.
• Review the steps in How to edit a configuration file in the Splunk Enterprise Admin Manual.

Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location. Make changes to the files in the local directory.

You must configure the proxy after you install the application, but before you complete the registration.

Steps

1. Install the Splunk Business Flow app.
2. Open or create a local sbf.conf file at $SPLUNK_HOME/etc/apps/splunk-business-flow/local. See the default sbf.conf file for reference.
3. Create the [proxy] stanza.
4. Set enabled to true.

Example sbf.conf configuration

The following is an example configuration for sbf.conf.

Overview

# sbf.conf

## Overview
This file contains configurations for Splunk Business Flow.

There is a sbf.conf in $SPLUNK_HOME/etc/apps/splunk-business-flow/default/ directory. Never change or copy the configuration files in the default directory. The files in the default directory must remain intact and in their original location.

To set custom configurations, create or edit a new file with the name sbf.conf in the $SPLUNK_HOME/etc/apps/splunk-business-flow/local/ directory. Then add the specific settings that you want to customize to the local configuration file. You must restart the Splunk platform to enable configurations.

To learn more about configuration files (including file precedence) see the documentation located at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

Server

## [server]
                                                                                                                                                                     
url_prod = <string>
* SBF hosted environment server to use.
* This will be automatically populated by SBF, you should not manually change it.
* Required.

Proxy

## [proxy]

enabled =  <boolean>
* Enables or disables the proxy. 
* Default: False

type = [http|http-no-tunnel|socks4|socks5]
* Type of proxy to use.
* Required.

host = <string>
* Proxy address, without the leading protocol. IP or DNS.
* Required.

port = <integer>
* Proxy port.
* Required.

user = <string>
* Username for proxy authentication.
* Optional.
* Default: Not set

pass = <string>
* Password for proxy authentication.
* Optional.
* Default: Not set

rdns = <true/false>
* If set to "true", DNS queries will be performed remotely.
* If set to "false", DNS queries will be performed locally.
* Optional.
* Default: false