Deployment Architecture

After upgrading search heads from Splunk 6.2.x to 6.3.x, why am I having proxy issues with my indexer cluster with error "browser is not supported"?

shahzadarif
Path Finder

I've had Splunk 6.2.1 running for a while and Search Heads were accessible from Apache proxy and this is how it is configured.

ProxyPass /splunk http://FQDN:8000
ProxyPassReverse /splunk http://FQDN:8000
ProxyPass /en-GB http://FQDN:8000/en-GB
ProxyPassReverse /en-GB http://FQDN:8000/en-GB
ProxyPass /en-US http://FQDN:8000/en-US
ProxyPassReverse /en-US http://FQDN:8000/en-US

This works with 6.2.x, but the moment server is upgraded to version 6.3.x, it stops working and I get error "browser is not supported".

I added root_endpoint = /splunk in web.conf under system/local, but that didn't resolve the issue. Search heads UI is accessible using FQDN:8000, so Splunk is working as expected with 6.3.3.
I've upgraded my indexers and cluster master and I've already configured multisite clustering on 6.3.3. But if I leave my Search Heads clustering to 6.2.x, then I can't get search heads connected to the cluster master because 6.2.x doesn't recognize multisite clustering, so I'm in a limbo.

PLEASE help me out. I'm desperate here and I need all this up and running before Friday. Thank you

0 Karma
1 Solution

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

View solution in original post

shahzadarif
Path Finder

Managed to fix this issue. This is the fix if someone else comes across the same issue.
In system local inputs.conf file change host value to your proxy url so instead of having something like:
host = servername
It should be:
host = www.yourproxyaddress.con

Create a web.conf file in system local and add the following stanza to it.
[settings]
root_endpoint = /splunk

Now configure your apache conf file to route /splunk to www.yourproxyaddress.con/splunk

jplumsdaine22
Influencer

Thanks for posting your answer! Be sure to click Accept answer (above this comment) to mark the question complete

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...