topic How to completely disable ProxyConfig? in Monitoring Splunk

How to completely disable ProxyConfig?

ricotries — Wed, 30 Sep 2020 05:31:43 GMT

I have a Splunk Enterprise instance (v7.3.4) and I am wondering if there is a way to completely disable ProxyConfig in server.conf? Every time the software restarts there's 4 informational logs in splunkd.log related to the 4 proxy settings (http_proxy, https_proxy, proxy_rules, and no_proxy), but I don't really care since I won't be enabling any outside communication. Is this required behavior or did I do something to trigger these startup messages?

Re: How to completely disable ProxyConfig?

PavelP — Fri, 22 May 2020 22:01:33 GMT

Hello @ricotries,

AFAIK this function is compiled in the splunk binary, so you cannot disable it.

What you can do is to change the logging level for ProxyConfig to WARN. Create a file /opt/splunk/etc/log-local.cfg with following content:

[splunkd]
category.ProxyConfig=WARN

and restart splunk

Re: How to completely disable ProxyConfig?

ricotries — Sat, 23 May 2020 15:38:56 GMT

Is this the equivalent of filtering by severity level in syslog?

Re: How to completely disable ProxyConfig?

PavelP — Sat, 23 May 2020 19:28:27 GMT

Hello @ricotries

yes, sort of
https://docs.splunk.com/Documentation/Splunk/8.0.3/AdvancedDev/ModInputsLog

I've tested this solution and it works

Re: How to completely disable ProxyConfig?

Jamie — Thu, 18 Nov 2021 17:12:33 GMT

Hello. Has anyone pushed out this configuration to Universal Forwarders using a Deployment Manager? Thanks.

Re: How to completely disable ProxyConfig?

sbrice18 — Wed, 24 Aug 2022 18:07:54 GMT

What was your findings on pushing this out to a universal forwarder? I am looking at the same thing since we see this error from 3k+ forwarders. 🙂

Re: How to completely disable ProxyConfig?

Jamie — Thu, 25 Aug 2022 13:21:25 GMT

It didn't work for the UFs (but did for Splunk servers from memory).