Deployment Architecture

Is there a way to only use DNS to connect to a search head?

tmarlette
Motivator

I have two ways to connect to a search head, and 1 is secured with SSL, while the other is not.

1: https://ip:port
2: https://dns.name.com:port

Is there a way I can disable option 1, and force everyone to use the DNS name?

Richfez
SplunkTrust
SplunkTrust

I'm not sure there's a way to remove the ability to access it via IP address, but you could use variants of the following search to find those who are doing it.

index=_internal sourcetype=splunk_web_access | stats count by referer_domain, user

Then perhaps a kindly worded email could take care of the problem?

0 Karma

ddrillic
Ultra Champion

Interesting. The best practice is to use a load balancer with search head clustering

Meaning, the users should access the load balancer which is in front of the search heads as a cluster or not...

0 Karma

tmarlette
Motivator

agreed, however no load balancer is available.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...