Deployment Architecture

After upgrading search heads from Splunk 6.2.x to 6.3.x, why am I having proxy issues with my indexer cluster with error "browser is not supported"?

shahzadarif
Path Finder

I've had Splunk 6.2.1 running for a while and Search Heads were accessible from Apache proxy and this is how it is configured.

ProxyPass /splunk http://FQDN:8000
ProxyPassReverse /splunk http://FQDN:8000
ProxyPass /en-GB http://FQDN:8000/en-GB
ProxyPassReverse /en-GB http://FQDN:8000/en-GB
ProxyPass /en-US http://FQDN:8000/en-US
ProxyPassReverse /en-US http://FQDN:8000/en-US

This works with 6.2.x, but the moment server is upgraded to version 6.3.x, it stops working and I get error "browser is not supported".

I added root_endpoint = /splunk in web.conf under system/local, but that didn't resolve the issue. Search heads UI is accessible using FQDN:8000, so Splunk is working as expected with 6.3.3.
I've upgraded my indexers and cluster master and I've already configured multisite clustering on 6.3.3. But if I leave my Search Heads clustering to 6.2.x, then I can't get search heads connected to the cluster master because 6.2.x doesn't recognize multisite clustering, so I'm in a limbo.

PLEASE help me out. I'm desperate here and I need all this up and running before Friday. Thank you

0 Karma
1 Solution

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

View solution in original post

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

jplumsdaine22
Influencer

Thanks for posting your answer! Be sure to click Accept answer (above this comment) to mark the question complete

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...