How do I fix 500 Internal Server error when using ...

Deployment Architecture

I am encountering internal server errors when clicking on the open in search magnifying glass. These are large queries (approximately 5.5K characters in the request).

Some details:
Splunk version is 8.2.2.1
Single search head with 2 indexers
Splunk is on-prem behind an Apache reverse proxy

I tried setting the LimitRequestLine and LimitRequestFieldSize to larger values in the Apache config with no success.

The Apache access_logs report the 500 error but no other really useful information.

Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...