Security

Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found)

rupeshn
Explorer

Hi All,

We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.

We could see all the dashboards but the saved searches and queries on dashboard cannot run.

It shows error as following "Search could not start/found

Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"

Could you please look into this and advice what could be the reason ?

0 Karma

uwehermann
Engager

What software/hardware are you using as a reverse proxy? And how is that set up?

Any info on what is inside the following two files could also be helpful.
$SPLUNK_HOME/var/log/splunk/web_access.log
$SPLUNK_HOME/var/log/splunk/web_service.log

Also the logfiles for the reverse proxy could be helpful.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...