https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110628#M4192 <P>Hi,</P> <P>You can refer this document <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/UseSHCwithloadbalancers">http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/UseSHCwithloadbalancers</A></P> <P>Thanks,<BR /> Harshil</P> Fri, 27 Mar 2015 13:42:14 GMT harsmarvania57 2015-03-27T13:42:14Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110627#M4191 <P>We don’t have anything set up currently for load balancing and this is something we are planning for first time using new version (6.2) of splunk. The load balancer set up I am looking for is F5 residing between the users and the cluster members (search heads).</P> <P>Can anyone provide the process or documentation for setting this up ?</P> Wed, 10 Jun 2020 19:27:17 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110627#M4191 spsrasru 2020-06-10T19:27:17Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110628#M4192 <P>Hi,</P> <P>You can refer this document <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/UseSHCwithloadbalancers">http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/UseSHCwithloadbalancers</A></P> <P>Thanks,<BR /> Harshil</P> Fri, 27 Mar 2015 13:42:14 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110628#M4192 harsmarvania57 2015-03-27T13:42:14Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110629#M4193 <P>Hello,</P> <P>We just built a new SH Cluster and put ours behind an F5.<BR /> Nothing too complicated to setup. You will need a VIP associated to URL that users can get to, ex: Splunk.Company.com</P> <P>Have that forward to your Search Peers IP's<BR /> 10.x.x.x, 10.x.x.x, 10.x.x.x</P> <P>If you use the default ports (8000 for web), make sure you change the port forwarding.</P> <P>Last, enable sticky sessions.</P> <P>If you find that every time you login, it seems to reset and make you log in again, you probably are missing the sticky sessions.</P> <P>Thanks,<BR /> James</P> Fri, 27 Mar 2015 15:07:59 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110629#M4193 jmheaton 2015-03-27T15:07:59Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110630#M4194 <P>Thanks for your response! I am confused with the statement "Have that forward to your Search Peers IP's".</P> <P>You mean forward to our search head IP's ?</P> <P>Thanks,<BR /> Sam</P> Fri, 27 Mar 2015 15:36:58 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110630#M4194 spsrasru 2015-03-27T15:36:58Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110631#M4195 <P>Yeah, i have been working on an index cluster project and wrote peers instead of heads <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 27 Mar 2015 15:41:36 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110631#M4195 jmheaton 2015-03-27T15:41:36Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110632#M4196 <P>no problem. Appreciate your response.</P> <P>Thanks,<BR /> Sam</P> Fri, 27 Mar 2015 15:44:14 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110632#M4196 spsrasru 2015-03-27T15:44:14Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110633#M4197 <P>We set it up but I am getting an xml page when i browse using just the VIP. The VIP will listen for https requests on 443 and forward to the real servers on 4301. </P> <P>Can you please suggest ? </P> <P>Appreciate your help on this!</P> Thu, 07 May 2015 15:49:03 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110633#M4197 spsrasru 2015-05-07T15:49:03Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110634#M4198 <P>Hi @jmheaton, did you also make your Search Heads HTTPS based? If yes, please share the method you used to configure that. Thanks.</P> Mon, 25 Mar 2019 03:37:22 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110634#M4198 damode 2019-03-25T03:37:22Z https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110635#M4199 <P>What do you mean by 'stick session'?</P> Wed, 13 May 2020 13:43:06 GMT https://community.splunk.com/t5/Deployment-Architecture/how-to-configure-Splunk-search-head-cluster-behind-an-F5-load/m-p/110635#M4199 kaku72 2020-05-13T13:43:06Z