Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.
I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.
Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?
Thanks! Damon
Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example
Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER
(e.g., session_id_8000
) cookie. Will that do the trick?
ProxyPass / balancer://mycluster/ stickysession=session_id_8000 nofailover=On timeout=15
ProxyPassReverse / balancer://mycluster/ stickysession=session_id_8000
BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000
Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.
Here is my Apache config snippet (more or less straight out of the Apache docs):
That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.