Using Splunk rest api, I get 401 clustered

[mariocioffi]

Hi, I have created a cluster of 3 nodes,

and I use Splunk rest api to perform a login,

I regularly get a sessionkey after the login,

but if in the next call I call a node other than the one that logged me in,

I get a 401 even if I pass the sessionkey in the call,

How can I share login information between nodes?

I am unable to run a sticky session between nodes

[mariocioffi]

ok , the architecture

ELB

|

Apache as a service in Container EKS, with php page that call Backend ELB

|

Bachend ELB

|                |              |

node1 node2 node3

the problem is that stickiness is not maintained when switching from the container, and a different splunk node is called each time, even if the backend elb implements the session cookie

i hope everything is clear, so i would need to share login sessions between nodes no matter which server is called

[mariocioffi]

Hi isoutamo

thank you for response,

the elb over cluster have already has the sticky session active, unfortunately it is invoked by a container system that does not accept the session cookie, so is there a way to share the sessionkey between the cluster nodes?

[isoutamo]

Could you tell more about your architecture? How it has done and which component you have inside EKS or what is your container system? How you are defined access between EKS and  other components?

[isoutamo]

Hi

your said that this is cluster. Do you mean SHC with deployer?

If so, you must have LB before it and use sticky session for normal web traffic and also for REST API traffic. How this will done, is depending on your LB. 
r. Ismo

[mariocioffi]

I add that for the login I'm using admin credentials