Security

Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found)

rupeshn
Explorer

Hi All,

We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.

We could see all the dashboards but the saved searches and queries on dashboard cannot run.

It shows error as following "Search could not start/found

Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"

Could you please look into this and advice what could be the reason ?

0 Karma

uwehermann
Engager

What software/hardware are you using as a reverse proxy? And how is that set up?

Any info on what is inside the following two files could also be helpful.
$SPLUNK_HOME/var/log/splunk/web_access.log
$SPLUNK_HOME/var/log/splunk/web_service.log

Also the logfiles for the reverse proxy could be helpful.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...