topic Re: Unable to run curl command in Production which has vip enabled in Getting Data In

Unable to run curl command in Production which has vip enabled

kamal_jagga — Thu, 04 Feb 2016 17:16:21 GMT

Hi,

I am trying to run a saved search using curl command. This works fine in lower environment but does not work in Production (which has vip)
Works fine in Lower
curl -k -u username:Password https://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
Tried all the below option in Prod
curl -k -u username:Password http://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://localhost:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://myservername-vip.com:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://myservername.com:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://10.20.30.400.:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://10.20.30.400.:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -w username:Password -k http://10.20.30.400:9086/services/saved/searches/testkamal/reschedule -H -d schedule_time=2012-08-15T14:11:01Z

Kindly advise.

Re: Unable to run curl command in Production which has vip enabled

lguinn2 — Thu, 04 Feb 2016 17:28:40 GMT

What error do you see? What is "vip"? I think this is probably an issue with port and/or permission settings for security in the production environment. That probably doesn't have anything to do with Splunk.

Re: Unable to run curl command in Production which has vip enabled

kamal_jagga — Thu, 04 Feb 2016 18:01:47 GMT

Error is
HTTP 303 code
"The resource has moved temporarily "

VIP : used for masking the URL using irules.

Re: Unable to run curl command in Production which has vip enabled

jplumsdaine22 — Thu, 04 Feb 2016 20:40:20 GMT

I assume you mean some sort of Layer 7 load balancer. You will need to get in touch with your network admins and confirm what port they are connecting to splunk and over what protocol. My guess is they are only connecting to port 8080 (the web ui port) and do not have any redirection in place for the management port. Make sure they load balance the management port for you as well.

Re: Unable to run curl command in Production which has vip enabled

kamal_jagga — Thu, 04 Feb 2016 21:00:34 GMT

Would you be able to give some more details about the following line.

"Make sure they load balance the management port for you as well "

Do we need to check whether the mgmt port (8089) is open on load balancer or somewhere else ?

Re: Unable to run curl command in Production which has vip enabled

jplumsdaine22 — Thu, 04 Feb 2016 21:32:28 GMT

Currently you probably have a vip address https://your-vip.com:8080 that you use to connect to the splunk UI

Your load balancer admins need to provide you with https://your-vip.com:8089, that then connects to https://your-splunk.com:8089

(Although the port on your-vip.com can be anything as long as it maps to the correct management port on your splunk server)

Re: Unable to run curl command in Production which has vip enabled

kamal_jagga — Thu, 04 Feb 2016 22:23:21 GMT

Thanks.
i got the mgmt port and used that in the command. Updating the port to the management port fixed the issue.

Thank you !!!