Security

Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found)

rupeshn
Explorer

Hi All,

We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.

We could see all the dashboards but the saved searches and queries on dashboard cannot run.

It shows error as following "Search could not start/found

Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"

Could you please look into this and advice what could be the reason ?

0 Karma

uwehermann
Engager

What software/hardware are you using as a reverse proxy? And how is that set up?

Any info on what is inside the following two files could also be helpful.
$SPLUNK_HOME/var/log/splunk/web_access.log
$SPLUNK_HOME/var/log/splunk/web_service.log

Also the logfiles for the reverse proxy could be helpful.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...