I have one Splunk deployment (search head + indexers) set up in our internal corp network. Whenever we have proxy issues preventing the reachability to external network our Splunk instance gets impacted as well - search head cannot reach indexers.
Internal network - search head can reach indexers, I am wondering if this is something I did not set up right?
Why search head needs the proxy to reach indexers since they both residents internally?
Thanks for the quick reply!
Under what kind of situations we need internet connectivity for splunk? all the traffics for my instance are from internal networks I believe, is there way to disable use proxy?
It depends, if you are using any add-on/app which are downloading data from external API or any external URL then you require internet access via proxy otherwise Splunk does not require internet access.
You can check below configuration in server.conf
[proxyConfig] http_proxy = <string> * If set, splunkd sends all HTTP requests through the proxy server that you specify. * No default. https_proxy = <string> * If set, splunkd sends all HTTPS requests through the proxy server that you specify. * If not set, splunkd uses the 'http_proxy' setting instead. * No default.