Security

Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found)

rupeshn
Explorer

Hi All,

We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.

We could see all the dashboards but the saved searches and queries on dashboard cannot run.

It shows error as following "Search could not start/found

Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"

Could you please look into this and advice what could be the reason ?

0 Karma

uwehermann
Engager

What software/hardware are you using as a reverse proxy? And how is that set up?

Any info on what is inside the following two files could also be helpful.
$SPLUNK_HOME/var/log/splunk/web_access.log
$SPLUNK_HOME/var/log/splunk/web_service.log

Also the logfiles for the reverse proxy could be helpful.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...