Apache Proxy - Splunk displays "waiting for data..."

[phwinkler]

Hi all,

my first post here - so hello to everyone!
My Name is Philipp and I live in Munich/Germany

Maybe you can help me with this one:

I am running Splunk behind an Apache Proxy using SSL

When I open a dashboard - for example with 4 panels only two show results and the other two show "waiting for data..."

It does not seem to be a perfomance problem with the Splunk Server
For example one Panel that does not show data has this info:

This search has completed and has returned 5 results by scanning 2,174 events in 0.322 seconds.

Reloading the page again shows 2 panel results - the other ones with "waiting for data.."
Sometimes it is panel 1+2 showing data, sometimes 1+3, sometimes 2+4 and so on..

The Apache Proxy serves more than just splunk, the URL is:

https://apacheserver.tld/splunk/

My Splunk web.conf is (only the modified stuff):

enableSplunkWebSSL = 1
root_endpoint = /splunk
tools.proxy.on = True

My Apache Config:

<Location "/splunk/">
ProxyPass https://10.x.x.x:8000/splunk/ retry=10 timeout=300 
</Location>

Maybe someone has experienced this problem and can give me a hint?
That would be great!
Thanks in advance!

Philipp

[phwinkler]

Thanks for your reply.

I do not see any valuable information in the splunkd logfiles.
It seems to be only related to custom dashboards.
Also I tested with a local connection - same thing - so it does not seem to be an apache proxy problem at all..

Maybe you have another idea where I could look for an error?

Thanks a lot!

[gkanapathy]

You need to add to your Apache config:

<Location "/splunk/">
ProxyPass https://10.x.x.x:8000/splunk retry=10 timeout=300
ProxyPassReverse https://10.x.x.x:8000/splunk
</Location>

Also note that I have removed the trailing slash (/) from your config. You may also want to use the ProxyPassReverseCookiePath.

[lukejadamec]

Are you seeing any information in the splunkd logs?
Is this related to dashboards from supported apps, or custom dashboards?
Have you tested this with the local connection bypassing the proxy?