Security

Is there any Keep Alive method for SplunkWeb in LB environment ?

mzorzi
Splunk Employee
Splunk Employee

I have a pair of Search Servers A + B , these are fronted by a Load Balancer so the users just go to a single IP Address and could get routed to either web server.

We want the Load Balancer to perform simple keep alive checking on the two Search Servers. I thought I could achieve this by dropping in a simple keepAlive.html file for the LB to check.

I have tried placing this in /share/splunk/search_mrsparkle/exposed and having the LB attempt to retrieve it using /static/keepAlive.html , however splunkweb changes this to /en-GB/static/keepAlive.html and returns HTTP-401.

Is my approach incorrect, how would you go about this if possible ?

Tags (1)

dwaddle
SplunkTrust
SplunkTrust

Is there any reason to not have the load balancer monitor the indexer's login page? (https://your.splunk.server:8043/en-US/account/login) That is as good of an indicator that splunkweb is running as anything else might be.

Simeon
Splunk Employee
Splunk Employee

The load balancer (LB) will need to be sticky to the search head you are searching. There is not any keep alive handling that I am aware of for this type of scenario. If you need to access some specific file on the server that does not require authentication, then you may need to use a different path. I don't believe that path will work.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...