Security

Sticky Sessions with Splunk Search Heads behind Apache Reverse-Proxy

damonmiller
New Member

Hello. I have a set of 3 or so search-heads that have matching configurations. I am trying to configure an Apache Reverse-Proxy to load-balance between these servers to maximize search capacity and to handle HTTPS encoding, etc.

I have sucessfully setup the proxy to point to a single search head, but when I configure more than one, I find the sessions continuing to round-robin between servers, intead of "sticking" to on search head after a session is established. I have followed a few recommendations as documented on the Apache mod_proxy and mod_proxy_balancer docs, but so far can't make this work.

Does splunk have any standardized session variables, like "JSESSIONID" or the like I could leverage? Any other suggestions? Has anyone gotten this to work?

Thanks! Damon

Tags (3)
0 Karma

damonmiller
New Member

Finally got this working using Apache's internal balancer cookies (ROUTEID) as described in http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html#example

0 Karma

David
Splunk Employee
Splunk Employee

Haven't tried it myself, but looking at my splunk instance, it looks like there is a session_id_HTTPPORTNUMBER (e.g., session_id_8000) cookie. Will that do the trick?

damonmiller
New Member


ProxyPass / balancer://mycluster/ stickysession=session_id_8000 nofailover=On timeout=15

ProxyPassReverse / balancer://mycluster/ stickysession=session_id_8000


BalancerMember http://10.x.x.10:8000
BalancerMember http://10.x.x.11:8000

0 Karma

damonmiller
New Member

Hmmm. I tried adding that session cookie to the apache config, but can't seem to make that work- I am continually redirected back to the Splunk login screen when more than one backend proxies are configured. I'm assuming this is a session issue, because proxying a single backend server works fine, its when I add two or more that the behavior starts... I suppose this is more an Apache issue than Splunk, but I thought someone must have tried this.

Here is my Apache config snippet (more or less straight out of the Apache docs):

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

That's correct. The port number is the listen port of the Splunk Web process, 8000 by default.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...