Getting Data In

Splunk search head docker behind nginx reverse proxy - how to deactivate test basic http on startup?

wfskmoney
Path Finder

my container starts behind nginx (web ssl deactivated), but then fails and restarts every minute:

FAILED - RETRYING: Test basic https endpoint (60 retries left).

since my nginx routes www.mysplunkserver.com:443/80 to container, :8000 is not routed for now.

Is there a way to  deactivate basic https endpoint test?

[settings]
enableSplunkWebSSL = 0
httpport = 8000
tools.proxy.on = true
Tags (1)
0 Karma
1 Solution

wfskmoney
Path Finder

The solution was that I changed the admin password inside Splunk, which was different from the SPLUNK_PASSWORD environment in the docker-compose file. This needs to be in sync:

    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=MustBeTheSameAsManuallyChangedAdminPassword

View solution in original post

0 Karma

wfskmoney
Path Finder

The solution was that I changed the admin password inside Splunk, which was different from the SPLUNK_PASSWORD environment in the docker-compose file. This needs to be in sync:

    environment:
      - SPLUNK_START_ARGS=--accept-license
      - SPLUNK_PASSWORD=MustBeTheSameAsManuallyChangedAdminPassword
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...