Configure splunkd to use your HTTP Proxy Server
You can set up an HTTP proxy server for splunkd so that all HTTP/S traffic originating from splunkd flows through the proxy server.
To set up a proxy server for splunkd, you can either configure Splunk's proxy variables in
server.conf or configure the REST endpoints.
This process configures Splunk to Splunk communication through a Proxy. The settings documented here do not support interactions outside of Splunk, for example:
- Access to Splunkbase via Splunk Web
- Splunk external lookups
- Actions that make a REST API call to an external service outside of a firewall
server.conf to configure splunkd to work with your server proxy
For a single Splunk Enterprise instance, you can add the proxy configs under
%SPLUNK_HOME/etc/system/local, or deploy a custom app that includes a server.conf file with your proxy settings. To configure multiple instances (pool of indexers, search head cluster, etc.) use a deployment management tool such as the deployer, deployment server, or cluster manager node to deploy an app that includes a server.conf file with your proxy settings.
[proxyConfig] http_proxy = <string that identifies the server proxy. When set, splunkd sends all HTTP requests through this proxy server. The default value is unset.> https_proxy = <string that identifies the server proxy. When set, splunkd sends all HTTPS requests through the proxy server defined here. If not set, splunkd uses the proxy defined in http_proxy. The default value is unset.> no_proxy = <string that identifies the no proxy rules. When set, splunkd uses the [no_proxy] rules to decide whether the proxy server needs to be bypassed for matching hosts and IP Addresses. Requests going to localhost/loopback address are not proxied. Default is "localhost, 127.0.0.1, ::1">
Use REST endpoints to configure splunkd to work with your server proxy
You can also configure splunkd to work with your HTTP proxy server by modifying the
/services/server/httpsettings/proxysettings REST endpoint. To set variables using a REST endpoint, you must have the
curl -k /services/server/httpsettings/proxysettings --data name="proxyConfig"
Write to the stanza:
curl -k /services/server/httpsettings/proxysettings/proxyConfig --data "http_proxy=....&https_proxy=...&no_proxy=...."
Read from stanza:
curl -k /services/server/httpsettings/proxysettings/proxyConfig
Delete the stanza:
curl -k -X DELETE /services/server/httpsettings/proxysettings/proxyConfig
Configure clusters to work with a proxy
Install and configure your HTTP Proxy Server for splunkd
Best practices when configuring an HTTP Proxy Server for splunkd
This documentation applies to the following versions of Splunk® Enterprise: 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 9.0.0, 9.0.1