Use Splunk Web with a reverse proxy configuration

Splunk web can be placed behind a proxy in a reverse proxy type of configuration. If you are hosting Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.

For example if your proxy hosts Splunk Web at "yourhost.com:9000/splunk", root_endpoint should be set to /splunk.

Note: The App Manager is not supported for use with a proxy server, if you use a proxy server with Splunk Web, you must download and update apps manually.

Typical Reverse Proxy Configuration

Lets take an example where Splunk Web is accessed via http://splunk.example.com:8000/lzone instead of http://splunk.example.com:8000/.

For enable this behavior, please set the following in web.conf

root_endpoint=/lzone

For a Apache proxy server, you would then make it visible to the proxy by mapping it in httpd.conf. Please check the documentation for additional information.

# Maps remote servers into the local server URL-space
ProxyPass /lzone http://splunkweb.splunk.com:8000/lzone

#Adjusts the URL in HTTP response headers sent from a reverse proxied server
ProxyPassReverse /lzone http://splunkweb.splunk.com:8000/lzone