Security

How do I properly configure proxy for Splunk?

szabados
Communicator

I'm running Splunk 6.5.2 on a Windows Server 2012 R2, and I just cannot get the proxy working.
I've tried setting it in splunk-launch.conf, and/or as an environmental variable for both http_proxy and httpS_proxy , but none of them helped, I'm getting Winsock 10061 errors all the time. I've tried both formats: : and http(s)://:.
Besides that, I want to use a couple apps (downloaded from Splunkbase), some of them has their own configuration where I can specify the proxy settings, and I'm getting '407 Proxy Authentication Required' errors.
However, our proxy does not need authentication. I've tried running web requests with the same python modules used in the apps (urllib2, requests), and worked from me.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Another answers post suggested configuring rhe http_proxy like:

http_proxy=a_user:a_password@proxy.local:80

Did you try with your credentials? Sounds like your proxy requires auth.

https://answers.splunk.com/answers/59873/how-to-get-splunk-to-work-behind-a-proxy.html

- MattyMo
0 Karma

szabados
Communicator

Update:

So, this 407 issue has been sorted, not with authentication, but now Splunk is able to open connections towards the public web, but not in all the cases. Some of my threat feeds in Enterprise Security work nicely, but some of them are still failing. I have no other idea where I could configure the proxy, or what is causing this inconsistent behavior.

0 Karma

gjanders
SplunkTrust
SplunkTrust

For Splunk ES you can Download a threat intelligence feed from the Internet in Splunk Enterprise Security refer to the "Configure a proxy for retrieving threat intelligence" section.

Note in my setup I use the ES level setup for using a proxy and not the above mentioned version...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...