Security

Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller
New Member

Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.

I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.

Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?

Thanks! Damon

Tags (3)
0 Karma

damonmiller
New Member

Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example

0 Karma

David
Splunk Employee
Splunk Employee

Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER (e.g., session_id_8000) cookie. Will that do the trick?

damonmiller
New Member


ProxyPass / balancer://mycluster/ stickysession=session_id_8000 nofailover=On timeout=15

ProxyPassReverse / balancer://mycluster/ stickysession=session_id_8000


BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000

0 Karma

damonmiller
New Member

Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.

Here is my Apache config snippet (more or less straight out of the Apache docs):

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...