- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Where do I point my REST API if I have search ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If I have Search-Head-Pooling configured, where do I point my REST API? To a physical server? If so, doesn't that defeat the purpose?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.
Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well , you'd likely connect through your load balancer which would route your connection request to 1 of the instances of the Search Head Pool and maintain affinity to that instance for the duration of your REST API session connection.
Or , you could connect to each Search Head instance directly. Really depends on the use case you are trying to satisfy.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thought so. OK, thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
8000 is your Splunk Web port. You'd need a Load Balancing rule for HTTPS protocol on port 8089 (or whatever port you have setup for you management port) and with session affinity/sticky session configured.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, my load-balancer listen for the management port - it listens on port 8000 - do people setup a separate load-balance for the REST API, or am I missing something?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
