We've added a self signed cert to our haproxy server which passes traffic on to our search head cluster. After doing so, I changed the following on web.conf
[settings] tools.proxy.on = true tools.proxy.base = https://internalhost.local
I can't seem to find any configuration value in my web or server settings that calls out 127.0.01 which puts me at a loss for what to adjust.
haproxy works fantastic with Splunk. But you should not need to make any changes to Splunk configs. I've found that routing to a SHC via haproxy, the most important config is to configure sticky sessions on haproxy. The SHC does not seem to react well to round-robin via haproxy (probably because of search artifact replication/destination).
Instead use "balance source"
Take off your Splunk settings and configure haproxy as such (partial example):
listen splunk_search_heads bind *:443 ssl crt /etc/haproxy/name_of_your_pem_file_here.pem bind :80 mode tcp balance source server shc01 xxx.xxx.xxx.31:8000 weight 1 maxconn 2000 check port 8000 ssl verify none server shc02 xxx.xxx.xxx.32:8000 weight 1 maxconn 2000 check port 8000 ssl verify none server shc03 xxx.xxx.xxx.33:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
Worth noting, in haproxy configs not shown in this partial example, I have all traffic redirected to 443, so the bind :80 is still secure.