Splunk redirecting to 127.0.0.1 behind haproxy

[jking81]

We've added a self signed cert to our haproxy server which passes traffic on to our search head cluster. After doing so, I changed the following on web.conf

[settings]
tools.proxy.on = true
tools.proxy.base = https://internalhost.local

Now when trying to visit https://internalhost.local it properly maintains https and redirects to https://internalhost.local/en-US, which then redirects to https://127.0.0.1:8000.

I can't seem to find any configuration value in my web or server settings that calls out 127.0.01 which puts me at a loss for what to adjust.

[codebuilder]

haproxy works fantastic with Splunk. But you should not need to make any changes to Splunk configs. I've found that routing to a SHC via haproxy, the most important config is to configure sticky sessions on haproxy. The SHC does not seem to react well to round-robin via haproxy (probably because of search artifact replication/destination).

Instead use "balance source"

Take off your Splunk settings and configure haproxy as such (partial example):

listen splunk_search_heads
    bind *:443 ssl crt /etc/haproxy/name_of_your_pem_file_here.pem
    bind :80
    mode tcp
    balance source
    server shc01 xxx.xxx.xxx.31:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
    server shc02 xxx.xxx.xxx.32:8000 weight 1 maxconn 2000 check port 8000 ssl verify none
    server shc03 xxx.xxx.xxx.33:8000 weight 1 maxconn 2000 check port 8000 ssl verify none

[codebuilder]

Worth noting, in haproxy configs not shown in this partial example, I have all traffic redirected to 443, so the bind :80 is still secure.

[codebuilder]

Did this help resolve your issue? If so, please "accept" the answer so that it may benefit the community.