how to configure Splunk search head cluster behind an F5 load balancer ?

[spsrasru]

We don’t have anything set up currently for load balancing and this is something we are planning for first time using new version (6.2) of splunk. The load balancer set up I am looking for is F5 residing between the users and the cluster members (search heads).

Can anyone provide the process or documentation for setting this up ?

[jmheaton · Accepted solution]

Hello,

We just built a new SH Cluster and put ours behind an F5.
Nothing too complicated to setup. You will need a VIP associated to URL that users can get to, ex: Splunk.Company.com

Have that forward to your Search Peers IP's
10.x.x.x, 10.x.x.x, 10.x.x.x

If you use the default ports (8000 for web), make sure you change the port forwarding.

Last, enable sticky sessions.

If you find that every time you login, it seems to reset and make you log in again, you probably are missing the sticky sessions.

Thanks,
James

[kaku72]

What do you mean by 'stick session'?

[damode]

Hi @jmheaton, did you also make your Search Heads HTTPS based? If yes, please share the method you used to configure that. Thanks.

[spsrasru]

We set it up but I am getting an xml page when i browse using just the VIP. The VIP will listen for https requests on 443 and forward to the real servers on 4301.

Can you please suggest ?

Appreciate your help on this!

[spsrasru]

Thanks for your response! I am confused with the statement "Have that forward to your Search Peers IP's".

You mean forward to our search head IP's ?

Thanks,
Sam

[jmheaton]

Yeah, i have been working on an index cluster project and wrote peers instead of heads 🙂

[spsrasru]

no problem. Appreciate your response.

Thanks,
Sam

[harsmarvania57]

Hi,

You can refer this document http://docs.splunk.com/Documentation/Splunk/6.2.2/DistSearch/UseSHCwithloadbalancers

Thanks,
Harshil