How to get Splunk to work behind a proxy

mikebrooker — Mon, 28 Sep 2020 12:30:27 GMT

I need to configured Splunk (running on RHEL6) to work behind a proxy, I tried the recommended approach and it didn't work. On each I restarted Splunk, also note yum-cron/updates works fine.

To get around this problem, you need to set the http_proxy environment variable. For permanent results, you can specify the setting in the splunk-launch.conf configuration file, located in $SPLUNK_HOME/etc/ on *nix systems and %SPLUNK_HOME%\etc\ on Windows.
In splunk-launch.conf, add this attribute/value pair:
http_proxy = :
For example:
http_proxy = 10.1.8.11:8787
I then tried this:
added to opt/splunk/etc/system/default/prefs.conf
proxy=http://proxy.local:80/
proxy_username=xxxx
proxy_password=xxxxx

Questions

1) On Linux, which is the correct file to add the proxy settings? I have seen atleast 3 files mentioned, being:
splunk-launch.conf
prefs.configuration
editing the /etc/init.d/splunk startup script

2) Does the proxy environment variable follow a typical Linux format?
For example, are these valid?

proxy=http://proxy.local:80/
proxy_username=a_user
proxy_password=a_password

Acquire::http::proxy "http://a_user:a_password@proxy.local:80/";

What is the correct why to achieve access from behind a proxy?

Re: How to get Splunk to work behind a proxy

MarioM — Wed, 26 Sep 2012 20:43:36 GMT

1) http_proxy=proxy.local:80 in splunk-launch.conf

2) splunk uses urllib2 then it should support the following parameters http_proxy=a_user:a_password@proxy.local:80 but you will need to try as i am not sure :

Re: How to get Splunk to work behind a proxy

sworisbreathing — Tue, 06 Aug 2013 01:19:55 GMT

http_proxy=a_user:a_password@proxy.local:80 worked for me (I also set the same value as https_proxy)

topic How to get Splunk to work behind a proxy in Security

How to get Splunk to work behind a proxy

Re: How to get Splunk to work behind a proxy

Re: How to get Splunk to work behind a proxy