https://community.splunk.com/t5/Security/Why-am-I-getting-errors-with-my-Apache-proxy-and-Splunk/m-p/168581#M4971 <P>I have an Apache proxy running on the same server (CentOS 6) as Splunk (v 6.1.4).</P> <P>My proxy config looks like:</P> <PRE><CODE>ProxyPass /splunk <A href="http://127.0.0.1:8001/splunk" target="test_blank">http://127.0.0.1:8001/splunk</A> ProxyPassReverse /splunk <A href="http://127.0.0.1:8001/splunk" target="test_blank">http://127.0.0.1:8001/splunk</A> </CODE></PRE> <P>Splunk is running on port 8001 because something else is already running on port 8000.</P> <P>In my /opt/splunk/etc/system/local/web.conf I have:</P> <PRE><CODE>httpport = 8001 root_endpoint = /splunk enableSplunkWebSSL = True tools.proxy.on = True (I have tried both True and False here) trustedIP=127.0.0.1 </CODE></PRE> <P>After I restart both Apache and Splunk, I get the following in my browser:</P> <PRE><CODE>Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request GET /splunk. Reason: Error reading from remote server </CODE></PRE> <P>In my logs I am getting the following:</P> <PRE><CODE>(104)Connection reset by peer: proxy: error reading status line from remote server 127.0.0.1 proxy: Error reading from remote server returned by /splunk </CODE></PRE> <P>I have port 8001 open through IP tables. I have been following the documentation from the Splunk but nothing seems to be working. Any help will be greatly appreciated.</P> Wed, 15 Oct 2014 22:42:43 GMT rccscalum 2014-10-15T22:42:43Z https://community.splunk.com/t5/Security/Why-am-I-getting-errors-with-my-Apache-proxy-and-Splunk/m-p/168581#M4971 <P>I have an Apache proxy running on the same server (CentOS 6) as Splunk (v 6.1.4).</P> <P>My proxy config looks like:</P> <PRE><CODE>ProxyPass /splunk <A href="http://127.0.0.1:8001/splunk" target="test_blank">http://127.0.0.1:8001/splunk</A> ProxyPassReverse /splunk <A href="http://127.0.0.1:8001/splunk" target="test_blank">http://127.0.0.1:8001/splunk</A> </CODE></PRE> <P>Splunk is running on port 8001 because something else is already running on port 8000.</P> <P>In my /opt/splunk/etc/system/local/web.conf I have:</P> <PRE><CODE>httpport = 8001 root_endpoint = /splunk enableSplunkWebSSL = True tools.proxy.on = True (I have tried both True and False here) trustedIP=127.0.0.1 </CODE></PRE> <P>After I restart both Apache and Splunk, I get the following in my browser:</P> <PRE><CODE>Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request GET /splunk. Reason: Error reading from remote server </CODE></PRE> <P>In my logs I am getting the following:</P> <PRE><CODE>(104)Connection reset by peer: proxy: error reading status line from remote server 127.0.0.1 proxy: Error reading from remote server returned by /splunk </CODE></PRE> <P>I have port 8001 open through IP tables. I have been following the documentation from the Splunk but nothing seems to be working. Any help will be greatly appreciated.</P> Wed, 15 Oct 2014 22:42:43 GMT https://community.splunk.com/t5/Security/Why-am-I-getting-errors-with-my-Apache-proxy-and-Splunk/m-p/168581#M4971 rccscalum 2014-10-15T22:42:43Z https://community.splunk.com/t5/Security/Why-am-I-getting-errors-with-my-Apache-proxy-and-Splunk/m-p/168582#M4972 <P>You have a mismatch in protocols there. You have told splunk to use SSL (enableSplunkWebSSL = True) but your proxy is set to just do http.</P> <P>So either update the splunk web.conf to have<BR /> enableSplunkWebSSL = False</P> <P>Or in your Apache update the config to be:</P> <P>SSLProxyEngine On<BR /> ProxyPass /splunk <A href="https://127.0.0.1:8001/splunk">https://127.0.0.1:8001/splunk</A> <BR /> ProxyPassReverse /splunk <A href="https://127.0.0.1:8001/splunk">https://127.0.0.1:8001/splunk</A></P> Wed, 11 Mar 2015 16:13:53 GMT https://community.splunk.com/t5/Security/Why-am-I-getting-errors-with-my-Apache-proxy-and-Splunk/m-p/168582#M4972 czzpl9 2015-03-11T16:13:53Z