Why does Splunk keep crashing when I try to download software?

[mrw5641]

Hello, my Splunk keeps crashing when I try to download software ever since I added in the [proxy_config] and http:// and https:// to the server.conf file...

When its not in there, it doesn't crash.

[proxyConfig]
http_proxy=http://hostname:9997
https_proxy=https://hostname:9997

[build a0c72a66db66] 2018-08-30 12:41:25
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 7157 running under UID 0.
Crashing thread: TcpChannelThread

[DimasSouza]

by definition a port can't be served as http and https at the same time. Try somethin linke this:

if your proxy serves an unencrypted port

[proxyConfig]
http_proxy=http://hostname:<http_port>
https_proxy=http://hostname:<http_port>

OR
if your proxy serves through an encrypted port

[proxyConfig]
http_proxy=https://hostname:<https_port>
https_proxy=https://hostname:<https_port>

Of course, you need a proxy software serving your proxy port...

[sebastianstruwe]

Hi DimasSouza,
this solution didn't work for me. If I use only https in proxyConfig, there is no connection to splunkbase. If I use only http in proxyConfig, splunkd still crashes.

[nickhills]

Is your proxy doing SSL inspection?

If so, you may have problems because the Splunk process will not be able to validate the connection to splunkbase. - This could explain why the connection is failing using SSL

There are several workarounds you could apply, but in my experience request an "inspection-bypass" from your security team was the path of least resistnace, albeit with a business justification.

None of that explains why splunkd crashes with the alternative - that is not something i have seen before.

[mrw5641]

Hi MuS, yes that is correct... I changed the proxy port and the server is still crashing...

[MuS]

your proxy port is 9997 which normally is the SplunkTCP default port ... is that correct?

cheers, MuS