The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
Dave Jones's Page
Gifts Received
Dave Jones has not received any gifts yet
Latest Activity
Keith Lawson commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"I am still having problems getting Splunk 4 to recognize a Reverse Proxy with .htpasswd file authentication. Can you see if you can get it working your system. With Splunk 3 this worked fine with the following httpd.conf
ServerAdmin…"
Dave Jones commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"I'd completely overlooked root_endpoint. I should've looked for that option knowing that the Splunk devs have thought of far more obscure settings. Thanks!"
Sasha commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"Additionally, thanks for your comment on serverfault!"
Sasha commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"True.
In that case, you might as well isolate Splunk in its own 'directory' via the following configuration directives:
Apache configuration:
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk…"
Dave Jones commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"Sasha,
That is more compact if you want to forward ALL requests to Splunk. However, I have other apps running behind that same instance of Apache, so I had to selectively proxy.
But thanks for pointing out that it can be made simpler if you only…"
Sasha commented on Dave Jones's blog post Configuring Apache as a reverse proxy to Splunk"A more compact version of the Apache2 directives would be:
ProxyRequests off
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
Additionally, the following must be set in the Splunk 4.x web.conf:
tools.proxy.on =…"
Dave Jones's blog post was featuredConfiguring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for…See More
Dave Jones posted a blog postConfiguring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for…See More
Dave Jones's blog post was featuredUsing the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:crcSalt = <SOURCE>Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt…See More
Dave Jones posted a blog postUsing the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:crcSalt = <SOURCE>Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt…See More
Michael Wilde left a comment for Dave Jones"Welcome Dave... thanks for signing up. If you see stuff you need help with, or have hard questions, please post them.
If you have ideas for videos i can do.. submit them as well. I'm happy to whip them out...
Michael Wilde
Splunk Ninja."
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- architecture, admin, and dev, mostly around WebSphere Portal
- Web / Blog Address
- http://www.perficient.com
Dave Jones's Blog
Configuring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the… Continue
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the… Continue
Posted on November 16, 2009 at 6:46am — 6 Comments
Using the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The… Continue
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The… Continue
Posted on October 2, 2009 at 12:00pm
Comment Wall (1 comment)
- At 9:52pm on September 26, 2009, Michael Wilde said…
- Welcome Dave... thanks for signing up. If you see stuff you need help with, or have hard questions, please post them.
If you have ideas for videos i can do.. submit them as well. I'm happy to whip them out...
Michael Wilde
Splunk Ninja.
© 2012 Created by Michael Wilde.
