Deployment Architecture

After upgrading search heads from Splunk 6.2.x to 6.3.x, why am I having proxy issues with my indexer cluster with error "browser is not supported"?

shahzadarif
Path Finder

I've had Splunk 6.2.1 running for a while and Search Heads were accessible from Apache proxy and this is how it is configured.

ProxyPass /splunk http://FQDN:8000
ProxyPassReverse /splunk http://FQDN:8000
ProxyPass /en-GB http://FQDN:8000/en-GB
ProxyPassReverse /en-GB http://FQDN:8000/en-GB
ProxyPass /en-US http://FQDN:8000/en-US
ProxyPassReverse /en-US http://FQDN:8000/en-US

This works with 6.2.x, but the moment server is upgraded to version 6.3.x, it stops working and I get error "browser is not supported".

I added root_endpoint = /splunk in web.conf under system/local, but that didn't resolve the issue. Search heads UI is accessible using FQDN:8000, so Splunk is working as expected with 6.3.3.
I've upgraded my indexers and cluster master and I've already configured multisite clustering on 6.3.3. But if I leave my Search Heads clustering to 6.2.x, then I can't get search heads connected to the cluster master because 6.2.x doesn't recognize multisite clustering, so I'm in a limbo.

PLEASE help me out. I'm desperate here and I need all this up and running before Friday. Thank you

0 Karma
1 Solution

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

View solution in original post

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

jplumsdaine22
Influencer

Thanks for posting your answer! Be sure to click Accept answer (above this comment) to mark the question complete

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...