Why does setting HTTPS_PROXY in Splunk 6.4.0 cause the web server to crash (500 - Internal Server error)?

[szabados]

I'm running 6.4.0. The HTTP_PROXY variable was configured in my splunk-launch.conf, and later I've configured the HTTPS_PROXY as well. After restarting Splunk, I'm prompted for login, but no other page can be loaded after that. (500 - Internal Server error).

How can I get the HTTPS proxy to work?

[jkat54]

Some folks have suggested a reboot was required. Have you tried clearing your cache with ctrl + f5?

[szabados]

Tried both but no luck

[jkat54]

Also if it's linux, it appears you can just set the environmental variables https_proxy or http_proxy.

https://answers.splunk.com/answers/2670/set-a-proxy-variable-for-splunk-to-get-out-to-the-internet.h...

Finally, I wonder if https_proxy is even needed, or if it works without http_proxy also being specified.

Hopefully this gives you some ideas to try.

[sjohnson_splunk]

Pretty sure that link is regards to having the Splunk server (script or some modular input) be able to go out to the internet via a proxy server.

If you are putting a proxy server in front of splunkweb (for something like SSO) you should take a look at the web.conf.spec file for the appropriate settings.

[aosso · Accepted solution]

Hi,

There's a known issue for version 6.4.0 related to HTTPS_PROXY:

http://docs.splunk.com/Documentation/Splunk/6.4.0/ReleaseNotes/KnownIssues#Highlighted_issues

HTTPS_PROXY in splunk-launch.conf causes 500 Internal Server Error after login. To work around this issue:
Option 1: Export the following setting into your environment prior to starting Splunk Enterprise: NO_PROXY="127.0.0.1,localhost,[::1]"

export NO_PROXY="127.0.0.1,localhost,[::1]"
or add it to $SPLUNK_HOME/etc/splunk-launch.conf and restart Splunk Enterprise.

Option 2: Unset the proxy on the Linux system and restart Splunk Enterprise:

echo $http{,s}_proxy
unset http{,s}_proxy 
If the proxy is set in splunk-launch.conf but is not actually used or needed, remove the setting and restart.

This was fixed on 6.4.1, I'd consider doing an upgrade.

http://docs.splunk.com/Documentation/Splunk/6.4.1/ReleaseNotes/6.4.1

2016-04-12  SPL-117139  HTTPS_PROXY environment variable set causes 500 Internal Server Error after login.