Security

Is there any Keep Alive method for SplunkWeb in LB environment ?

mzorzi
Splunk Employee
Splunk Employee

I have a pair of Search Servers A + B , these are fronted by a Load Balancer so the users just go to a single IP Address and could get routed to either web server.

We want the Load Balancer to perform simple keep alive checking on the two Search Servers. I thought I could achieve this by dropping in a simple keepAlive.html file for the LB to check.

I have tried placing this in /share/splunk/search_mrsparkle/exposed and having the LB attempt to retrieve it using /static/keepAlive.html , however splunkweb changes this to /en-GB/static/keepAlive.html and returns HTTP-401.

Is my approach incorrect, how would you go about this if possible ?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Is there any reason to not have the load balancer monitor the indexer's login page? (https://your.splunk.server:8043/en-US/account/login) That is as good of an indicator that splunkweb is running as anything else might be.

Simeon
Splunk Employee
Splunk Employee

The load balancer (LB) will need to be sticky to the search head you are searching. There is not any keep alive handling that I am aware of for this type of scenario. If you need to access some specific file on the server that does not require authentication, then you may need to use a different path. I don't believe that path will work.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...