Security

Apache Proxy - Splunk displays "waiting for data..."

phwinkler
Explorer

Hi all,

my first post here - so hello to everyone!
My Name is Philipp and I live in Munich/Germany

Maybe you can help me with this one:

I am running Splunk behind an Apache Proxy using SSL

When I open a dashboard - for example with 4 panels only two show results and the other two show "waiting for data..."

It does not seem to be a perfomance problem with the Splunk Server
For example one Panel that does not show data has this info:

This search has completed and has returned 5 results by scanning 2,174 events in 0.322 seconds.

Reloading the page again shows 2 panel results - the other ones with "waiting for data.."
Sometimes it is panel 1+2 showing data, sometimes 1+3, sometimes 2+4 and so on..

The Apache Proxy serves more than just splunk, the URL is:

https://apacheserver.tld/splunk/

My Splunk web.conf is (only the modified stuff):

enableSplunkWebSSL = 1
root_endpoint = /splunk
tools.proxy.on = True

My Apache Config:

<Location "/splunk/">
ProxyPass https://10.x.x.x:8000/splunk/ retry=10 timeout=300 
</Location>

Maybe someone has experienced this problem and can give me a hint?
That would be great!
Thanks in advance!

Philipp

0 Karma

phwinkler
Explorer

Thanks for your reply.

I do not see any valuable information in the splunkd logfiles.
It seems to be only related to custom dashboards.
Also I tested with a local connection - same thing - so it does not seem to be an apache proxy problem at all..

Maybe you have another idea where I could look for an error?

Thanks a lot!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You need to add to your Apache config:

<Location "/splunk/">
ProxyPass https://10.x.x.x:8000/splunk retry=10 timeout=300
ProxyPassReverse https://10.x.x.x:8000/splunk
</Location>

Also note that I have removed the trailing slash (/) from your config. You may also want to use the ProxyPassReverseCookiePath.

0 Karma

lukejadamec
Super Champion

Are you seeing any information in the splunkd logs?
Is this related to dashboards from supported apps, or custom dashboards?
Have you tested this with the local connection bypassing the proxy?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...