Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bobbycrispbox
bobbycrispbox
Explorer
Member since:
02-09-2017
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 02-09-2017 |
Activity Feed
- Got Karma for Splunk behind a reverse proxy refuses to stay on https. 10-04-2021 10:46 PM
- Got Karma for Splunk behind a reverse proxy refuses to stay on https. 06-05-2020 12:48 AM
- Posted Re: Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 04-06-2017 03:03 PM
- Posted Re: How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 03:04 PM
- Posted How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Tagged How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Tagged How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Tagged How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Tagged How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Tagged How to use the eval replace function in dashboard xml on Dashboards & Visualizations. 02-14-2017 02:34 PM
- Posted Re: Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 02-13-2017 02:14 PM
- Posted Re: Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 02-09-2017 05:12 PM
- Posted Re: Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 02-09-2017 12:21 PM
- Posted Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 02-09-2017 02:33 AM
- Tagged Splunk behind a reverse proxy refuses to stay on https on Deployment Architecture. 02-09-2017 02:33 AM
Topics I've Started
04-06-2017
03:03 PM
No, the workaround remains in place
... View more
02-14-2017
03:04 PM
I should point out that a b c d could be a b c d e f -- I need to keep this solution general to accept any number of space-separated inputs. Your solution looks like it would need to fix the number of outputs.
I note that replace does work as I would have expected in the context of a search, like this:
*|eval inputfield="a b c d"|eval outputfield="('"+replace(inputfield," ","'','")+"')" |table inputfield outputfield
but it does not in the context of a dashboard input.
... View more
02-14-2017
02:34 PM
Note this question relates to the replace eval function, not the replace search command. I've been referring to the documentation in https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/CommonEvalFunctions
My requirement is to take a list of space-delimited values in an input field and turn it into a comma-separated list for passing to the search For example, a b c d in the input should be transformed to ('a','b','c','d'). Here's my input definition from the dashboard:
<input type="text" searchWhenChanged="false" token="order_number">
<label>Order Number</label>
<default></default>
<change>
<eval token="order_number_q">if($value$=="","","('"+replace(ltrim(rtrim($value$))," +","','")+"') ")</eval>
</change>
</input>
The issue is that only the first instance of the space is replaced - so with my example above I'm ending up with ('a','b c d')
Documentation on the replace evaluation function is light, and I haven't found anyone else in Splunk Answers experiencing this behavior.
... View more
02-13-2017
02:14 PM
Thanks to jtacy for your assistance with this. I have not resolved my specfic issue but your answers have given me confidence that I'm doing the right things in my configuration. The problem probably lies elsewhere in the apache config. Until I work out what it is, I'll continue to use my additional virtualhost redirect from port 80 to port 443.
... View more
02-09-2017
05:12 PM
Thanks again jtacy
Yes, works perfectly when I hit https://172.23.9.2:8443/
I had to modify the curl command a bit to get what you wanted (had to pass a host header as it's a name-based virtual host), here's the result
root@debian:~# curl -v -k -o /dev/null -H 'Host: splunk.mydomain.com' https://172.23.9.2
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Error reading ca cert path /etc/ssl/certs - PolarSSL: (-0x2900) X509 - Read/write of file failed
GET / HTTP/1.1
User-Agent: curl/7.40.0
Accept: /
Host: splunk.mydomain.com
< HTTP/1.1 303 See Other
< Date: Fri, 10 Feb 2017 01:07:00 GMT
< Server: Splunkd
< Content-Type: text/html; charset=UTF-8
< X-Content-Type-Options: nosniff
< Content-Length: 575
< Location: http://splunk.mydomain.com/en-US/
< Vary: Accept-Language,Accept-Encoding
< X-Frame-Options: SAMEORIGIN
<
{ [575 bytes data]
100 575 100 575 0 0 1704 0 --:--:-- --:--:-- --:--:-- 1706
root@debian:~#
It's a multi-purpose server (a bit of a sandbox) and I'm coming to the conclusion that there's something about its setup that is causing these problems. I can say that the VirtualHost is clean and has no specific rewrites or redirects.
... View more
02-09-2017
12:21 PM
Thanks jtacy for your response.
I've switched over to HTTPS on Splunk web but the problem persists.
Apache config:
<VirtualHost _default_:443>
ServerName splunk.mydomain.com
ServerAlias splunk.alias.mydomain.com
CustomLog ${APACHE_LOG_DIR}/access-splunk.mydomain.com.log combined
SSLProxyEngine on
<IfModule mod_proxy.c>
ProxyPass / https://127.0.0.1:8443/ retry=0
ProxyPassReverse / https://127.0.0.1:8443/
</IfModule>
</VirtualHost>
(note that the certificate settings are there, just not in this part of the apache config)
web.conf:
[settings]
enableSplunkWebSSL = true
httpport = 8443
Are there any other places I should look for misconfigured settings?
... View more
02-09-2017
02:33 AM
2 Karma
This is a problem I've been battling with for ages, and I feel like I've looked at every related splunk>answers post, I've Googled extensively for Apache, Splunk and CherryPy answers, and I just can't get it sorted.
The set-up is this: My splunk (free) instance sits on a server which also has an apache2 instance. The Splunk server listens only on the loopback address, at http://127.0.0.1:8000/. My apache server is taking the requests from wherever they come at https://splunk.mydomain.com/ and ProxyPasses them on to the local Splunk address.
Whenever I connect to my apache url, on https, the redirects (from / to /en-GB/, from /en-GB/ to /en-GB/app/launcher/ etc) every redirect comes back as http:// instead of https://.
I've tried so many different Apache directives, including:
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
RequestHeader set X-Forwarded-Ssl "on"
RequestHeader set X-Url-Scheme "https"
SetEnvIf X-Url-Scheme https HTTPS=1
and none seem to resolve the issue.
I've tried all sorts of variations in web.conf
enableSplunkWebSSL = true | false
tools.proxy.on = true | false
but none have led me to a solution.
In the end I've implemented a new VirtualHost listening on port 80 which forwards requests from http to https, but it's a horrible hack and a waste of system resources.
Can anyone tell me their recipes for putting an Apache reverse proxy with SSL in front of a Splunk instance running on the same server?
Current Apache configuration:
<VirtualHost _default_:443>
ServerName splunk.mydomain.com
ServerAlias splunk.alias.mydomain.com
CustomLog ${APACHE_LOG_DIR}/access-splunk.mydomain.com.log combined
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
RequestHeader set X-Forwarded-Ssl "on"
RequestHeader set X-Url-Scheme "https"
<IfModule mod_proxy.c>
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
SetEnvIf X-Url-Scheme https HTTPS=1
</IfModule>
</VirtualHost>
Current web.conf
[settings]
enableSplunkWebSSL = false
... View more
- Tags:
- splunk-enterprise
