[Docker] Splunk Proxy issues

lluke — Mon, 25 Apr 2022 20:43:04 GMT

Hi All,

I have setup Splunk behind a reverse proxy and all works fine when the port used by the proxy to receive traffic is 443, however when the host port in docker-compose is changed and a root_endpoint is being used Splunk returns "404 page not found".

Example 1 - Splunk-Traefik-without-Root-Endpoint

https://gist.github.com/lluked/771a1f7f9bbd8ef2581e8828f3b25f9e

When the proxy (Traefik) host port is mapped to 443, Splunk is accessible at https://localhost:443

ports: - "80:80" - "443:443"

When the proxy (Traefik) host port is mapped to 8443, Splunk is accessible at https://localhost:8443

ports: - "80:80" - "8443:443"

Both of these scenarios work as expected.

Example 2 - Splunk-Traefik-with-Root-Endpoint

https://gist.github.com/lluked/438b10a6321ff50feb8d704690a0cafc

When the proxy (Traefik) host port is mapped to 443, Splunk is accessible at https://localhost:443/splunk

ports: - "80:80" - "443:443"

When the proxy (Traefik) host port is mapped to 8443, Splunk returns error 404 at https://localhost:8443/splunk

ports: - "80:80" - "8443:443"

When the proxy (Traefik) host port is mapped to 443, but this is on a vm and a port on the host is mapped to 443 Splunk returns error 404 again (For example using Vagrant and mapping 8443 on the host to 443 on the vm and visiting https://localhost:8443/splunk )

ports: - "80:80" - "443:443"

config.vm.network "forwarded_port", id: "traefik_websecure", host: 8443, guest: 443

It's like Splunk is detecting requests are coming from a different port and throwing a 404 but only when root_endpoint is being used, and I cannot find any documentation relating to this.

Please can anyone help?

topic [Docker] Splunk Proxy issues in Splunk Enterprise

[Docker] Splunk Proxy issues