Learning, learning, learning . . . Our Splunk "expert" is gone, and the non-programmer gets to learn the task! How do you spell SPLUNK?
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde commented on Michael Wilde's video
Sure... When you do group mapping, map them to groups that don't have the domain admins in them. I have a separate OU=Groups that has "Splunk Users, Splunk Admins, Splunk Power Users" as group names, and specific users…
Mike Hartford commented on Michael Wilde's video
I want to give LDAP access to my splunk servcie but I don't want the LDAP users to have admin capabilitys in Splunk. Can I keep the domain admins out of Splunk if I have LDAP authentication???
Mike Hartford left a comment for Jonathan Hawes
Helow Jonathan,
Glad to have another Splunker. I've been useing Splunk for 2 years and am hooked. I leared how to spell splunk and | transaction too. you'll learn that one soon.
Go over to Splunk…
Mike Hartford commented on Mike Hartford's blog post 'tees for the holy day'
Holy Batskins Ninja, zzzzzwap zgruppp kapow a hidden stash, how great is that!!!!
The team that found them must have special bat senses and highly tooned Splunking skills
I like to wear Extra Lovable…
Dave Jones's Page
Gifts Received
Dave Jones has not received any gifts yet
Latest Activity
Keith Lawson commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
I am still having problems getting Splunk 4 to recognize a Reverse Proxy with .htpasswd file authentication. Can you see if you can get it working your system. With Splunk 3 this worked fine with the following httpd.conf
ServerAdmin…
Dave Jones commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
I'd completely overlooked root_endpoint. I should've looked for that option knowing that the Splunk devs have thought of far more obscure settings. Thanks!
Sasha commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
Additionally, thanks for your comment on serverfault!
Sasha commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
True.
In that case, you might as well isolate Splunk in its own 'directory' via the following configuration directives:
Apache configuration:
ProxyPass /splunk http://127.0.0.1:8000/splunk
ProxyPassReverse /splunk…
Dave Jones commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
Sasha,
That is more compact if you want to forward ALL requests to Splunk. However, I have other apps running behind that same instance of Apache, so I had to selectively proxy.
But thanks for pointing out that it can be made simpler if you only…
Sasha commented on Dave Jones's blog post 'Configuring Apache as a reverse proxy to Splunk'
A more compact version of the Apache2 directives would be:
ProxyRequests off
ProxyPass / http://127.0.0.1:8000/
ProxyPassReverse / http://127.0.0.1:8000/
Additionally, the following must be set in the Splunk 4.x web.conf:
tools.proxy.on =…
Dave Jones updated their profile
Configuring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for…See More
A blog post by Dave Jones was featured
Configuring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the ones for…See More
Blog post by Dave Jones
Using the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:crcSalt = <SOURCE>Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt…See More
A blog post by Dave Jones was featured
Using the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:crcSalt = <SOURCE>Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The Splunk docs describe the crcSalt…See More
Blog post by Dave Jones
Michael Wilde left a comment for Dave Jones
Welcome Dave... thanks for signing up. If you see stuff you need help with, or have hard questions, please post them.
If you have ideas for videos i can do.. submit them as well. I'm happy to whip them out...
Michael Wilde
Splunk Ninja.
Profile Information
- Are you an existing splunk user?
- Free
- What do you do for your day job?
- architecture, admin, and dev, mostly around WebSphere Portal
- Web / Blog Address
- http://www.perficient.com
Dave Jones's Blog
Configuring Apache as a reverse proxy to Splunk
My company has a demo VM running WebSphere Portal, and I also put Splunk on that server to help me troubleshoot it remotely much more efficiently. However, the only public traffic allowed into that VM is over ports 80 and 443.
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the… Continue
That VM already has an instance of Apache (IBM HTTP Server actually) running, and the WebSphere plugin makes it function as a reverse proxy to WebSphere Application Server. It's configuration handles it's own set of URIs, so I needed to make Apache handle the… Continue
Posted on November 16, 2009 at 6:46am — 6 Comments
Using the websphere_trlog_sys* source types
Splunk has graciously included the websphere_trlog_sysout and websphere_trlog_syserr source types out of the box. They seem to handle the log entries very well.
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The… Continue
However, due to the way IBM writes out these logs when they get rolled, you will also need to include the following line in your inputs.conf for your WAS logs:
crcSalt = <SOURCE>
Otherwise, Splunk will think it has already processed the log and ignore the new ones WebSphere AppServer creates. The… Continue
Posted on October 2, 2009 at 12:00pm
Comment Wall (1 comment)
- At 9:52pm on September 26, 2009,
Michael Wilde said…
- Welcome Dave... thanks for signing up. If you see stuff you need help with, or have hard questions, please post them.
If you have ideas for videos i can do.. submit them as well. I'm happy to whip them out...
Michael Wilde
Splunk Ninja.
© 2012 Created by Michael Wilde.
