The dojo of Splunk. Learn, share, teach, mentor.
-
Dave Jones
- Saint Louis, MO
- United States
- Share
- Share on Twitter
- Share on Facebook
- Blog Posts (2)
- Discussions
- Events
- Videos
Dave Jones's Page
Gifts Received
Dave Jones has not received any gifts yet
Latest Activity
I am still having problems getting Splunk 4 to recognize a Reverse Proxy with .htpasswd file authentication. Can you see if you can get it working your system. With Splunk 3 this worked fine with the following httpd.conf
ServerAdmin root@localhost…
I'd completely overlooked root_endpoint. I should've looked for that option knowing that the Splunk devs have thought of far more obscure settings. Thanks!
Additionally, thanks for your comment on serverfault!
True.
In that case, you might as well isolate Splunk in its own 'directory' via the following configuration directives:
Apache configuration:
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk http://127.0.0.1:8000/splunk
Sp…
Sasha,
That is more compact if you want to forward ALL requests to Splunk. However, I have other apps running behind that same instance of Apache, so I had to selectively proxy.
But thanks for pointing out that it can be made simpler if you only n…
A more compact version of the Apache2 directives would be:
ProxyRequests off
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
Additionally, the following must be set in the Splunk 4.x web.conf:
tools.proxy.on = True
(…
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.
That VM already has a…
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.
That VM already has a…
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also n…
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also n…
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- architecture, admin, and dev, mostly around WebSphere Portal
- Web / Blog Address
- http://www.perficient.com
Dave Jones's Blog
Configuring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for Spl… Continue
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for Spl… Continue
Posted on November 16, 2009 at 6:46am — 6 Comments
Using the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt… Continue
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt… Continue
Posted on October 2, 2009 at 11:00am —
Comment Wall (1 comment)
- At 8:52pm on September 26, 2009,
Michael Wilde said…
- Welcome Dave... thanks for signing up. If you see stuff you need help with, or have hard questions, please post them.
If you have ideas for videos i can do.. submit them as well. I'm happy to whip them out...
Michael Wilde
Splunk Ninja.
Videos
Latest Splunk Community Postings
Loading feed
Latest Splunk Forum Posts
Loading feed
© 2010 Created by Michael Wilde.
Powered by 
.
