Getting Data In

Splunk search head docker behind nginx reverse proxy - how to deactivate test basic http on startup?

wfskmoney
Path Finder

my container starts behind nginx (web ssl deactivated), but then fails and restarts every minute:

FAILED - RETRYING: Test basic https endpoint (60 retries left).

since my nginx routes www.mysplunkserver.com:443/80 to container, :8000 is not routed for now.

Is there a way to  deactivate basic https endpoint test?

[settings]
enableSplunkWebSSL = 0
httpport = 8000
tools.proxy.on = true
Tags (1)
0 Karma
1 Solution

wfskmoney
Path Finder

The solution was that I changed the admin password inside Splunk, which was different from the SPLUNK_PASSWORD environment in the docker-compose file. This needs to be in sync:

    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=MustBeTheSameAsManuallyChangedAdminPassword

View solution in original post

0 Karma

wfskmoney
Path Finder

The solution was that I changed the admin password inside Splunk, which was different from the SPLUNK_PASSWORD environment in the docker-compose file. This needs to be in sync:

    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=MustBeTheSameAsManuallyChangedAdminPassword
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...