Deployment Architecture

Splunk redirecting to 127.0.0.1 behind haproxy

jking81
Engager

We've added a self signed cert to our haproxy server which passes traffic on to our search head cluster. After doing so, I changed the following on web.conf

[settings]
tools.proxy.on = true
tools.proxy.base = https://internalhost.local

Now when trying to visit https://internalhost.local it properly maintains https and redirects to https://internalhost.local/en-US, which then redirects to https://127.0.0.1:8000.

I can't seem to find any configuration value in my web or server settings that calls out 127.0.01 which puts me at a loss for what to adjust.

0 Karma

codebuilder
SplunkTrust
SplunkTrust

haproxy works fantastic with Splunk. But you should not need to make any changes to Splunk configs. I've found that routing to a SHC via haproxy, the most important config is to configure sticky sessions on haproxy. The SHC does not seem to react well to round-robin via haproxy (probably because of search artifact replication/destination).

Instead use "balance source"

Take off your Splunk settings and configure haproxy as such (partial example):

listen splunk_search_heads
    bind *:443 ssl crt /etc/haproxy/name_of_your_pem_file_here.pem
    bind :80
    mode tcp
    balance source
    server shc01 xxx.xxx.xxx.31:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
    server shc02 xxx.xxx.xxx.32:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
    server shc03 xxx.xxx.xxx.33:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Worth noting, in haproxy configs not shown in this partial example, I have all traffic redirected to 443, so the bind :80 is still secure.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

codebuilder
SplunkTrust
SplunkTrust

Did this help resolve your issue? If so, please "accept" the answer so that it may benefit the community.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...