Deployment Architecture

Is there a way to only use DNS to connect to a search head?

Motivator

I have two ways to connect to a search head, and 1 is secured with SSL, while the other is not.

1: https://ip:port
2: https://dns.name.com:port

Is there a way I can disable option 1, and force everyone to use the DNS name?

SplunkTrust
SplunkTrust

I'm not sure there's a way to remove the ability to access it via IP address, but you could use variants of the following search to find those who are doing it.

index=_internal sourcetype=splunk_web_access | stats count by referer_domain, user

Then perhaps a kindly worded email could take care of the problem?

0 Karma

Ultra Champion

Interesting. The best practice is to use a load balancer with search head clustering

Meaning, the users should access the load balancer which is in front of the search heads as a cluster or not...

0 Karma

Motivator

agreed, however no load balancer is available.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!