topic Re: Why am I no longer able to access Splunkbase from a Search Head after upgrading to Splunk 6.3? in Deployment Architecture

Why am I no longer able to access Splunkbase from a Search Head after upgrading to Splunk 6.3?

balbano — Tue, 15 Dec 2015 21:34:57 GMT

Hi guys,

Not sure if anyone else is having this issue but it seems that ever since I upgrade to Splunk 6.3.x I can no longer access Splunkbase from the Search Head Instance like I used to.

I configured this to work through the proxy.

Can someone confirm with me that this should still work, and if so, which configurations I need to check?

Any help would be much appreciated.

Thanks.
Brian

Re: Why am I no longer able to access Splunkbase from a Search Head after upgrading to Splunk 6.3?

jkat54 — Wed, 16 Dec 2015 20:36:53 GMT

Restart your proxy... fix your proxy... can you curl splunkbase addresses from the server? If not, fix your proxy 😉

Re: Why am I no longer able to access Splunkbase from a Search Head after upgrading to Splunk 6.3?

balbano — Tue, 29 Sep 2020 08:10:31 GMT

Not the proxy... traffic from the search head is not even hitting the proxy to go out. This leads me to believe something may have changed in configuring Splunk to use the proxy to go out to splunkbase. I remember configuring it via Splunk application configuration and not global env variables. (i.e. http_proxy / https_proxy)

However, I did confirm that the proxy servers can reach splunkbase.

-Brian

Re: Why am I no longer able to access Splunkbase from a Search Head after upgrading to Splunk 6.3?

ssmoot_splunk — Tue, 29 Sep 2020 08:45:51 GMT

This has been identified as a bug and is resolved in patch 6.3.4.

SPL-112383 "search more apps" feature not working when using proxy

To detect if you are hitting this bug, you can verify in splunkd_ui_access.log that you are generating an HTTP error 502 when trying to reach:
http(s)://...../...../manager/search/appsremote?offset=0&count=20&order=latest