Hello, my Splunk keeps crashing when I try to download software ever since I added in the [proxy_config] and http:// and https:// to the server.conf file...
When its not in there, it doesn't crash.
[proxyConfig]
http_proxy=http://hostname:9997
https_proxy=https://hostname:9997
[build a0c72a66db66] 2018-08-30 12:41:25
Received fatal signal 6 (Aborted).
Cause:
Signal sent by PID 7157 running under UID 0.
Crashing thread: TcpChannelThread
by definition a port can't be served as http and https at the same time. Try somethin linke this:
if your proxy serves an unencrypted port
[proxyConfig]
http_proxy=http://hostname:<http_port>
https_proxy=http://hostname:<http_port>
OR
if your proxy serves through an encrypted port
[proxyConfig]
http_proxy=https://hostname:<https_port>
https_proxy=https://hostname:<https_port>
Of course, you need a proxy software serving your proxy port...
Hi DimasSouza,
this solution didn't work for me. If I use only https in proxyConfig, there is no connection to splunkbase. If I use only http in proxyConfig, splunkd still crashes.
Is your proxy doing SSL inspection?
If so, you may have problems because the Splunk process will not be able to validate the connection to splunkbase. - This could explain why the connection is failing using SSL
There are several workarounds you could apply, but in my experience request an "inspection-bypass" from your security team was the path of least resistnace, albeit with a business justification.
None of that explains why splunkd crashes with the alternative - that is not something i have seen before.
Hi MuS, yes that is correct... I changed the proxy port and the server is still crashing...
your proxy port is 9997
which normally is the SplunkTCP default port ... is that correct?
cheers, MuS