Security

How can I tell Splunk to use a HTTP_PROXY to phone home?

mctester
Communicator

After upgrading Splunk to v4.1.1, I've noticed that the Splunk server now "phone's home" over the Internet for some reason. Because the splunk server is on a network that requires an HTTP proxy, we now see the following errors in the splunkd.log upon startup:

04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text="Traceback (most recent call last):..."  
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" File "/opt/splunk/etc/system/bin/appsmanager.py", line 114, in handle_POST..."
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" with closing(urllib2.urlopen(self._login, post_args, URLOPEN_TIMEOUT)) as f:..."
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" File "/opt/splunk/lib/python2.6/urllib2.py", line 124, in urlopen..."
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" return _opener.open(url, data, timeout)..."
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" File "/opt/splunk/lib/python2.6/urllib2.py", line 395, in open..."
04-28-2010 13:48:32.270 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" response = meth(req, response)..."
04-28-2010 13:48:32.271 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" File "/opt/splunk/lib/python2.6/urllib2.py", line 508, in http_response..."
04-28-2010 13:48:32.271 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" 'http', request, response, code, msg, hdrs)..."
04-28-2010 13:48:32.271 WARN DateParserVerbose - Failed to parse timestamp for event. Text=" File "/opt/splunk/lib/python2.6/urllib2.py", line 433, in error..."

So, here are my questions:

1) What is this Internet connectivity required for?
2) Is there any way to specify an HTTP_PROXY on Splunk so that it can successfully phone home?

Tags (1)

Simeon
Splunk Employee
Splunk Employee

Splunk will try to connect home to verify versioning. You should disable this setting if you know that Splunk cannot reach splunk.com from it's location.

http://www.splunk.com/wiki/Community:ConfigureNoInternet

You should be able to use the http_proxy variable within python, although I have not verified this.

0 Karma

pinoyoz
New Member

Hi Simeon,

Where do you define this variable within python?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

I don't know what this is used for, but just from scanning the stack trace I might know how to make it use an outbound proxy.

It is using Python urllib, which can use an environment variable 'http_proxy' to specify the proxy server. Before starting splunkd, try an 'export proxy_server=my.proxy.server:port'

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...