topic Using Splunk rest api, I get 401 clustered in Splunk Dev

Using Splunk rest api, I get 401 clustered

mariocioffi — Wed, 26 Jul 2023 08:36:02 GMT

Hi, I have created a cluster of 3 nodes,

and I use Splunk rest api to perform a login,

I regularly get a sessionkey after the login,

but if in the next call I call a node other than the one that logged me in,

I get a 401 even if I pass the sessionkey in the call,

How can I share login information between nodes?

I am unable to run a sticky session between nodes

Re: Using Splunk rest api, I get 401 clustered

mariocioffi — Wed, 26 Jul 2023 08:37:18 GMT

I add that for the login I'm using admin credentials

Re: Using Splunk rest api, I get 401 clustered

isoutamo — Wed, 26 Jul 2023 10:46:05 GMT

your said that this is cluster. Do you mean SHC with deployer?

If so, you must have LB before it and use sticky session for normal web traffic and also for REST API traffic. How this will done, is depending on your LB.
r. Ismo

Re: Using Splunk rest api, I get 401 clustered

mariocioffi — Wed, 26 Jul 2023 12:00:07 GMT

Hi isoutamo

thank you for response,

the elb over cluster have already has the sticky session active, unfortunately it is invoked by a container system that does not accept the session cookie, so is there a way to share the sessionkey between the cluster nodes?

Re: Using Splunk rest api, I get 401 clustered

isoutamo — Wed, 26 Jul 2023 12:59:48 GMT

Could you tell more about your architecture? How it has done and which component you have inside EKS or what is your container system? How you are defined access between EKS and other components?

Re: Using Splunk rest api, I get 401 clustered

mariocioffi — Wed, 26 Jul 2023 13:47:04 GMT

ok , the architecture

ELB

Apache as a service in Container EKS, with php page that call Backend ELB

Bachend ELB

| | |

node1 node2 node3

the problem is that stickiness is not maintained when switching from the container, and a different splunk node is called each time, even if the backend elb implements the session cookie

i hope everything is clear, so i would need to share login sessions between nodes no matter which server is called