Deployment Architecture

After upgrading search heads from Splunk 6.2.x to 6.3.x, why am I having proxy issues with my indexer cluster with error "browser is not supported"?

shahzadarif
Path Finder

I've had Splunk 6.2.1 running for a while and Search Heads were accessible from Apache proxy and this is how it is configured.

ProxyPass /splunk http://FQDN:8000
ProxyPassReverse /splunk http://FQDN:8000
ProxyPass /en-GB http://FQDN:8000/en-GB
ProxyPassReverse /en-GB http://FQDN:8000/en-GB
ProxyPass /en-US http://FQDN:8000/en-US
ProxyPassReverse /en-US http://FQDN:8000/en-US

This works with 6.2.x, but the moment server is upgraded to version 6.3.x, it stops working and I get error "browser is not supported".

I added root_endpoint = /splunk in web.conf under system/local, but that didn't resolve the issue. Search heads UI is accessible using FQDN:8000, so Splunk is working as expected with 6.3.3.
I've upgraded my indexers and cluster master and I've already configured multisite clustering on 6.3.3. But if I leave my Search Heads clustering to 6.2.x, then I can't get search heads connected to the cluster master because 6.2.x doesn't recognize multisite clustering, so I'm in a limbo.

PLEASE help me out. I'm desperate here and I need all this up and running before Friday. Thank you

0 Karma
1 Solution

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

View solution in original post

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

jplumsdaine22
Influencer

Thanks for posting your answer! Be sure to click Accept answer (above this comment) to mark the question complete

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...