Related Answers
Download topic as PDF
Use Splunk Web with a reverse proxy configuration
Splunk web can be placed behind a proxy in a reverse proxy type of configuration. If you are hosting Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.
For example if your proxy hosts Splunk Web at "yourhost.com:9000/splunk", root_endpoint should be set to /splunk.
Note: The App Manager is not supported for use with a proxy server, if you use a proxy server with Splunk Web, you must download and update apps manually.
Typical Reverse Proxy Configuration
Lets take an example where Splunk Web is accessed via http://splunk.example.com:8000/lzone instead of http://splunk.example.com:8000/.
For enable this behavior, please set the following in web.conf
root_endpoint=/lzone
For a Apache proxy server, you would then make it visible to the proxy by mapping it in httpd.conf. Please check the documentation for additional information.
# Maps remote servers into the local server URL-space ProxyPass /lzone http://splunkweb.splunk.com:8000/lzone #Adjusts the URL in HTTP response headers sent from a reverse proxied server ProxyPassReverse /lzone http://splunkweb.splunk.com:8000/lzone
|
PREVIOUS Configure user session timeouts |
NEXT About the Splunk Enterprise AMI |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.0, 7.3.1
Comments
Most corporate proxies require authentication. Can someone add the semantics for that to the docs?
on opensuse 13.1 with splunk 6.3. does not work!
other programs fine.
Running Splunk Lite 6.3 on Ubuntu, still can't get this to work. Tried setting both http_proxy and https_proxy (both upper and lower) in /etc/environment, splunk-launch.conf, and well as adding the environment variable to the init script for splunkd. Environment variable works just fine from command line (wget, etc.) so I can't see what I might be missing.
This works, however it doesn't indicate whether you can specify a more complicated proxy configuration - like an automatic proxy configuration URL, even with a login/password requirement. That's what a lot of corporate firewalls have now. When Splunk can't get to these external web links, the server essentially locks up and has to be restarted. Is there an option to totally disable the splunk server from going out to the public internet, eliminating the need for a PROXY at all?
I have added these 2 lines to splunk-launch.conf:<br /><br />HTTP_PROXY=proxy.XXXXX.ca:8080<br />HTTPS_PROXY=proxy.XXXXX.ca:8080<br /><br />and restarted Splunk ( /etc/init.d/splunk restart ). Works like a charm, thanks!
I needed to add to splunk-launch.conf<br /><br />http_proxy=my.server.com:80<br />https_proxy=my.server.com:443<br /><br />The HTTP_PROXY and HTTPS_PROXY did not work. I also needed to reboot the server a simple restart splunk from the webui did not work. I tried this on 3 splunk servers.
Modular input with HTTP_PROXY?
If you make your modular input which needs to go through any proxy you have to implement your own proxy codes. HTTP_PROXY is only for the request from SplunkWeb. You can find many sample codes for that in the Internet.