Splunk with reverse proxy. After Authenticating, not able to see logs (Search could not found)

[rupeshn]

Hi All,

We'v implemented reverse proxy in our environment for authentication. We're able to login thorough our card but after logging in.

We could see all the dashboards but the saved searches and queries on dashboard cannot run.

It shows error as following "Search could not start/found

Following is the change that we've done in web.conf
root_endpoint = /
SSOMode = strict
trustedIP = proxy IP
remoteUser = user on proxy server
tools.proxy.on = false
enableWebDebug=true"

Could you please look into this and advice what could be the reason ?

[uwehermann]

What software/hardware are you using as a reverse proxy? And how is that set up?

Any info on what is inside the following two files could also be helpful.
$SPLUNK_HOME/var/log/splunk/web_access.log
$SPLUNK_HOME/var/log/splunk/web_service.log

Also the logfiles for the reverse proxy could be helpful.