Getting Data In

How to connect a Search Head to an Indexer via Proxy Server?

akanno
Communicator

Hi all.

I want to connect a Search Head to an Indexer via Proxy Server like so:
Search Head <===> Proxy Server <====> Indexer

I'm setting the following on the Search Head server:
http_proxy=172.31.48.51:8089
https_proxy=172.31.48.51:8089

Therefore, the Search Head was able to connect to the internet (e.g apps.splunk.com) via Proxy Server.

Search Head <===> Proxy Server <====> internet(e.g apps.splunk.com)

But the Search Head has connected directly to the Indexer.
I want to connect the search head to the indexer via Proxy Server!

Can I connect a search head to an indexer via proxy server?

0 Karma
1 Solution

sunrise
Contributor

You cannot connect from the search head to the indexer via proxy, a forward proxy server.
Because the session between a search head and an indexer may be not http, or https session as grijhwani said.

View solution in original post

sunrise
Contributor

You cannot connect from the search head to the indexer via proxy, a forward proxy server.
Because the session between a search head and an indexer may be not http, or https session as grijhwani said.

grijhwani
Motivator

Provided the proxy has routing to the indexer, knows to proxy on the port specified, and firewalling is not intercepting the traffic as being to a non-standard port, it should be fine.

But you need to bear in mind that just because the search head can use the proxy for http/https traffic on the standard ports (80/443) doesn't mean anything with regard to its ability to relay the Splunk traffic (default destination ports 8089 and 9997 depending, on the nature of the traffic).

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...