Content Encoding Error when running Splunk from behind a reverse-proxy

[zyamada]

Hi all,

I am encountering an error, "Content Encoding Error, The page you are trying to view cannot be shown because it uses an invalid or unsupported form of compression." when I attempt to access Splunk from behind a reverse-proxy running through apache. Splunk works fine when being access directly and not through the proxy.

Anyone know what may be causing this?

My /opt/splunk/etc/system/local/web.conf is as follows:

  [settings]
  enableSplunkWebSSL = 0
  tools.proxy.on = True

While my proxy configuration is....

  ProxyRequests Off
  ProxyPreserveHost On
  ProxyHTMLEnable On

  ProxyPass /splunk/ http://localhost:8000/
  ProxyPassReverse /splunk/ http://127.0.0.1:8000/
  ProxyPass /en-US http://127.0.0.1:8000/en-US
  ProxyPassReverse /en-US http://127.0.0.1:8000/en-US
  ProxyPass /static http://127.0.0.1:8000/static
  ProxyPassReverse /static http://127.0.0.1:8000/static
  ProxyPass /manager http://127.0.0.1:8000/manager
  ProxyPassReverse /manager http://127.0.0.1:8000/manager

I tried googling about and have yet to find anyone else who has experienced this issue before so I am hoping someone here may have an idea!

Thanks for all the help!

[ziegfried · Accepted solution]

Since all URI's in Splunkweb are typlically prefix by the locale, you should be able to create to reverse proxy settings just using the /en-US part (without using the HTML rewite stuff)

ProxyPreserveHost On
ProxyPass /en-US http://127.0.0.1:8000/en-US
ProxyPassReverse /en-US http://127.0.0.1:8000/en-US

In addition you could create a redirect rule to forward requests to /splunk to the /en-US