topic Re: Set a proxy variable for Splunk to get out to the Internet in Security

How to set a proxy variable for Splunk to get out to the Internet?

sdwilkerson — Thu, 17 Aug 2023 16:48:05 GMT

A site requires proxy-settings to be in place for every browser in order to go to the Internet.

There doesn't appear to be any configuration in Splunk to support http_proxy.

Without this, Splunk can not, for instance, browse to splunkbase (through the manager UI) to install new apps.

The user Splunk runs as can set the following in their environment (e.g. ~/.bashrc):
export http_proxy='http://proxyaddy:port'
export https_proxy='http://proxyaddy:port'

And then when that user restarts Splunk those environment variables are passed to Splunk. This is fine when the user does a restart, but this does not work when the system is rebooted or an init is changed.

Re: Set a proxy variable for Splunk to get out to the Internet

sdwilkerson — Wed, 19 May 2010 02:49:20 GMT

On Linux, here is a work-around (though a Splunk-internal config would be ideal):

Set the http_proxy variables to be exported and picked up by the init script. It is not Linux/RHEL recommended practice to customize start scripts installed via a package manager (e.g. RPM) since they might be replaced with the next upgrade/install.

Therefore the recommended solution is to edit the appropriate file in /etc/sysconfig.

Unfortunately, the RPMs that Splunk distributes as of VERSION=4.1.2 BUILD=79191 does not accomodate the RHEL-recommended usage of the /etc/sysconfig directory for localized settings.

Therefore, to accomodate best-practice for RHEL and add the proxy setting to make it reboot persistent do the following:

Edit/create the file /etc/sysconfig/splunk and enter the following lines (edit the proxyaddy and port appropriate to your environment):

# Export local proxy settings to allow Splunk to get out
export http_proxy='http://proxyaddy:port'
export https_proxy='http://proxyaddy:port'

Next edit the start script /etc/init.d/splunk to tell it to use the local settings file you just created (hopefully this will be added by Splunk in future versions of their RPMs

# Add a standard PROG var then check for the sysconfig script and run if available

PROG="splunk"

[ -f /etc/sysconfig/$PROG ] && . /etc/sysconfig/$PROG ]

The next time you do a system restart this should work properly. If you wanted to simulate how Splunk would be restarted by the system doing a reboot but without having to reboot you can do the following steps:

Ensure you have configured Splunk to run at reboot with the command: splunk enable boot-start
stop splunk (e.g. $SPLUNK_HOME/bin/splunk stop)
init 1
init 3

Re: Set a proxy variable for Splunk to get out to the Internet

gkanapathy — Sat, 22 May 2010 14:47:01 GMT

I suspect you could add this to splunk-launch.conf:

http_proxy=http://proxy:port
https_proxy=http://proxy:port

You can set other environment variables this way.

Re: Set a proxy variable for Splunk to get out to the Internet

sdwilkerson — Thu, 27 May 2010 04:09:45 GMT

Gerald,
I had tried this before with no joy. After seeing your comment, I just tried it again and still without the desired/expected result.
I believe the difference is that the VAR is not necessarily something Splunk needs but something that is passed to python which then uses it during external http calls.
Let me know your thoughts. I am here onsite until Friday so can test other ideas.

Re: Set a proxy variable for Splunk to get out to the Internet

petert2011 — Tue, 28 Jun 2011 05:35:19 GMT

Watch out for this one, after configuring https_proxy environment variable, the Cisco IPS script to connect to port 443 using SDEE to an IDSM was also using the proxy - and with no access from Proxy to port 443 on the IDSM all I was getting was 504 Gateway Errors in the sdee log file

It would be good if there was a configuration item within the manager to specify a proxy only for splunk's access to Splunk resources on the internet.

Re: Set a proxy variable for Splunk to get out to the Internet

pinoyoz — Wed, 18 Sep 2013 07:42:11 GMT

Hi Gerald,

I tried to use this config on my Windows machine but splunkd is not communicating with the proxy. I can access the proxy using a normal browser but not through the app.

Did anyone managed to get this working?

Thanks.

Re: Set a proxy variable for Splunk to get out to the Internet

seyvet — Wed, 29 Jan 2014 09:12:02 GMT

easy. works fine.

Re: Set a proxy variable for Splunk to get out to the Internet

chrisherdt — Thu, 20 Jun 2019 21:26:16 GMT

For more recent versions of Splunk (for example, version 7.3 in 2019), you can set proxy values in server.conf:

[proxyConfig]
http_proxy = http://proxy.example.com
https_proxy = https://proxy.example.com

See https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/ConfigureSplunkforproxy for details.

Re: Set a proxy variable for Splunk to get out to the Internet

hthiel — Mon, 06 Jul 2020 07:09:50 GMT

@chrisherdt, as you can read in your link, this option is not for Splunk to communicate to the outside, but for Splunk 2 Splunk communication through a proxy.

"This process configures Splunk to Splunk communication through a Proxy. The settings documented here do not support interactions outside of Splunk, for example:

Access to Splunkbase via Splunk Web
Splunk external lookups
Actions that make a REST API call to an external service outside of a firewall"

Re: Set a proxy variable for Splunk to get out to the Internet

securitypaul — Thu, 17 Aug 2023 12:32:38 GMT

Thank you for this 🙂