Splunk internal network use, still need proxy setup?

[xindeNokia]

I have one Splunk deployment (search head + indexers) set up in our internal corp network. Whenever we have proxy issues preventing the reachability to external network our Splunk instance gets impacted as well - search head cannot reach indexers.

Internal network - search head can reach indexers, I am wondering if this is something I did not set up right?

Why search head needs the proxy to reach indexers since they both residents internally?

Thanks!

[harsmarvania57]

Hi,

If your Search Head or Indexer do not require internet connectivity then it should not pass traffic via proxy.

[xindeNokia]

Thanks for the quick reply!
Under what kind of situations we need internet connectivity for splunk? all the traffics for my instance are from internal networks I believe, is there way to disable use proxy?

[harsmarvania57]

It depends, if you are using any add-on/app which are downloading data from external API or any external URL then you require internet access via proxy otherwise Splunk does not require internet access.

You can check below configuration in server.conf

[proxyConfig]
http_proxy = <string>
* If set, splunkd sends all HTTP requests through the proxy server
  that you specify.
* No default.

https_proxy = <string>
* If set, splunkd sends all HTTPS requests through the proxy server
  that you specify.
* If not set, splunkd uses the 'http_proxy' setting instead.
* No default.