Splunk Enterprise

Why is ELB over search head cluster via REST API not mantaining stickiness?


Hi everyone

We are currently facing an issue using a load balancer with a search head cluster. This is an Elastic Load Balancer in AWS and we can't use the Load Balancer cookie, has to be an application cookie. I have seen this issue before and seen people fix it by using the cookie session_id_PORTNUMBER, but our deployment doesn't need the user to connect to splunk web, it' just a service connecting through the ELB to the rest Api in port 8090(Had to change from default 8089). I have also tried splunkd_443 to no avail.

The problem is that the ELB is throwing the petitions for login and for getjobs to different servers.


Is there any other application cookie I could use? This is for splunk 9.0.4

Thanks everyone!

Labels (1)
Tags (2)
0 Karma



you could set sticky session with ALB. So switch ELB to ALB, then it should work with sticky session enabled.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...