Getting Data In

How to connect a Search Head to an Indexer via Proxy Server?

akanno
Communicator

Hi all.

I want to connect a Search Head to an Indexer via Proxy Server like so:
Search Head <===> Proxy Server <====> Indexer

I'm setting the following on the Search Head server:
http_proxy=172.31.48.51:8089
https_proxy=172.31.48.51:8089

Therefore, the Search Head was able to connect to the internet (e.g apps.splunk.com) via Proxy Server.

Search Head <===> Proxy Server <====> internet(e.g apps.splunk.com)

But the Search Head has connected directly to the Indexer.
I want to connect the search head to the indexer via Proxy Server!

Can I connect a search head to an indexer via proxy server?

0 Karma
1 Solution

sunrise
Contributor

You cannot connect from the search head to the indexer via proxy, a forward proxy server.
Because the session between a search head and an indexer may be not http, or https session as grijhwani said.

View solution in original post

sunrise
Contributor

You cannot connect from the search head to the indexer via proxy, a forward proxy server.
Because the session between a search head and an indexer may be not http, or https session as grijhwani said.

View solution in original post

grijhwani
Motivator

Provided the proxy has routing to the indexer, knows to proxy on the port specified, and firewalling is not intercepting the traffic as being to a non-standard port, it should be fine.

But you need to bear in mind that just because the search head can use the proxy for http/https traffic on the standard ports (80/443) doesn't mean anything with regard to its ability to relay the Splunk traffic (default destination ports 8089 and 9997 depending, on the nature of the traffic).

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.