Make a copy of $SPLUNK_HOME/etc/system/default/nf and place it into $SPLUNK_HOME/etc/system/local.Ģ. For a list of valid proxy attributes, see " Proxy configuration values." You cannot configure proxy servers in Splunk Web.Ĭonfigure a SOCKS5 proxy connection with configuration filesġ.
To configure a SOCKS5 proxy connection, edit stanzas in nf and specify certain attributes to enable the proxy. For information on this memo, see " Network Working Group: Request for Comments: 1928" ( ) on the IETF website. This implementation of the SOCKS5 client complies with the Internet Engineering Task Force (IETF) Request for Comments (RFC) Memo #1928. The proxy host establishes a connection to the indexer and the forwarder begins sending data through the proxy connection.Īny type of Splunk forwarder can send data through a SOCKS5 proxy host. After you configure and restart the forwarder, it connects to the SOCKS5 proxy host, and optionally authenticates to the server on demand if you provide credentials. You can do this by specifying attributes in a stanza in the nf configuration file on the forwarder. Starting with version 6.3 of Splunk Enterprise, you can configure a forwarder to use a SOCKS5 proxy host to send data to an indexer. If a firewall blocks connectivity between the forwarder and the indexer, the forwarder cannot send data to the indexer.
#Setting up splunk forwarder how to
This topic discusses how to configure a forwarder with a Socket Secure version 5 (SOCKS5) proxy server as a target with the intent of forwarding data to an indexer beyond the proxy server.īy default, a Splunk forwarder requires a direct network connection to any receiving indexers. Configure a forwarder to use a SOCKS proxy
0 kommentar(er)
