topic Re: Is it possible to have a common URL for Splunk? in Splunk Search

Is it possible to have a common URL for Splunk?

dbashyam — Tue, 22 Jan 2019 08:20:28 GMT

Hi,

We have three different URLs for Splunk for example, https://splunk1.com, https://splunk2.com; https://splunk3.com 2. User1, User2, User3, User4 will have access to all the splunk interface
User1 willl always access https://splunk1.com
User3 and User4 will always access https://splunk3.com
User2 will always access https://splunk2.com
Is it possible to have a single common interface like https://splunk_companyname.com so that the User1, User2, User3, User4, can go to their respective preferred interfaces?

Thanks for any inputs,
Dinesh

Re: Is it possible to have a common URL for Splunk?

FrankVl — Tue, 22 Jan 2019 08:39:04 GMT

What is behind those 3 different URLs? 3 different standalone search heads?

Do I understand it correctly that you basically want a common URL, and then redirect users based on their username to the respective splunk instance?

It's quite common to put a loadbalancer in front of your search heads / search head cluster. But I'm not sure if there are load balancers that can direct specific users to specific endpoints...

Re: Is it possible to have a common URL for Splunk?

dbashyam — Tue, 22 Jan 2019 16:09:56 GMT

Thanks @FrankVl

The three different URL's that I gave are itself LB's and underneath that we 3 or 4 search heads. For example

https://splunk1.com will have 3 search head, they are integrated via SHC
https://splunk2.com will have 2 or 4 search head, they are integrated via SHC like wise

Yes I want a common URL, so that when specific user who access a particular search ui should be directed to that UI without showing him the UI change (like implementing a .htaccess redirect rule in apache)

Is this something doable or any ideas how to come up with a single interface?

Thanks,
Dinesh

Re: Is it possible to have a common URL for Splunk?

FrankVl — Wed, 23 Jan 2019 09:59:15 GMT

I guess that would very much depend on the capabilities of the load balancing solution you have at your disposal. So would be good if you can perhaps share what load balancer you use?

I'm not much of an expert on that, this is also not really a splunk question, but perhaps there are people here that can still provide some suggestions.

Re: Is it possible to have a common URL for Splunk?

nickhills — Wed, 23 Jan 2019 13:26:35 GMT

Just to throw an additional idea into the mix..

Why do you have separate SHCs?
If its to do with performance and preventing users on one SHC consuming resources on the others, you might look at the new Workload Management functionality which came with 7.2 https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement

Overall, you would probably see a significant performance improvement by combining all of your searcheads into one cluster and using Workload management to share the resources according to your needs.

It would also give you only 1 url for all your users to reach.