I've had Splunk 6.2.1 running for a while and Search Heads were accessible from Apache proxy and this is how it is configured.
ProxyPass /splunk http://FQDN:8000
ProxyPassReverse /splunk http://FQDN:8000
ProxyPass /en-GB http://FQDN:8000/en-GB
ProxyPassReverse /en-GB http://FQDN:8000/en-GB
ProxyPass /en-US http://FQDN:8000/en-US
ProxyPassReverse /en-US http://FQDN:8000/en-US
This works with 6.2.x, but the moment server is upgraded to version 6.3.x, it stops working and I get error "browser is not supported".
I added root_endpoint = /splunk in web.conf under system/local, but that didn't resolve the issue. Search heads UI is accessible using FQDN:8000, so Splunk is working as expected with 6.3.3.
I've upgraded my indexers and cluster master and I've already configured multisite clustering on 6.3.3. But if I leave my Search Heads clustering to 6.2.x, then I can't get search heads connected to the cluster master because 6.2.x doesn't recognize multisite clustering, so I'm in a limbo.
PLEASE help me out. I'm desperate here and I need all this up and running before Friday. Thank you
Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con
Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk
Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk
Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con
Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk
Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk
Thanks for posting your answer! Be sure to click Accept answer (above this comment) to mark the question complete