Unable to run curl command in Production which has vip enabled

[kamal_jagga]

Hi,

I am trying to run a saved search using curl command. This works fine in lower environment but does not work in Production (which has vip)
Works fine in Lower
curl -k -u username:Password https://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
Tried all the below option in Prod
curl -k -u username:Password http://localhost:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://localhost:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://myservername-vip.com:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://myservername.com:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://10.20.30.400.:9086/services/saved/searches/testkamal2/reschedule -X POST
curl -k -u username:Password http://10.20.30.400.:8080/services/saved/searches/testkamal2/reschedule -X POST
curl -w username:Password -k http://10.20.30.400:9086/services/saved/searches/testkamal/reschedule -H -d schedule_time=2012-08-15T14:11:01Z

Kindly advise.

[jplumsdaine22 · Accepted solution]

I assume you mean some sort of Layer 7 load balancer. You will need to get in touch with your network admins and confirm what port they are connecting to splunk and over what protocol. My guess is they are only connecting to port 8080 (the web ui port) and do not have any redirection in place for the management port. Make sure they load balance the management port for you as well.

[kamal_jagga]

Would you be able to give some more details about the following line.

"Make sure they load balance the management port for you as well "

Do we need to check whether the mgmt port (8089) is open on load balancer or somewhere else ?

[jplumsdaine22]

Currently you probably have a vip address https://your-vip.com:8080 that you use to connect to the splunk UI

Your load balancer admins need to provide you with https://your-vip.com:8089, that then connects to https://your-splunk.com:8089

(Although the port on your-vip.com can be anything as long as it maps to the correct management port on your splunk server)

[kamal_jagga]

Thanks.
i got the mgmt port and used that in the command. Updating the port to the management port fixed the issue.

Thank you !!!

[lguinn2]

What error do you see? What is "vip"? I think this is probably an issue with port and/or permission settings for security in the production environment. That probably doesn't have anything to do with Splunk.

[kamal_jagga]

Error is
HTTP 303 code
"The resource has moved temporarily "

VIP : used for masking the URL using irules.