My splunk instance is is behind an apache proxy. Everything works correctly except for login. When i log into splunk, the return_to param is being url quoted twice, but only url unquoted once it seems.
e.g. I go to my host https://host/splunk and get redirected to the login screen with this url https://host/splunk/en-US/account/login?return_to=%252Fsplunk%252Fen-US%252F
(note the return_to being quoted twice). After i authenticate i get a 404 at http://app241.auto.mobileiron.com/%2Fsplunk%2Fen-US%2F (notice not https, and the quoted path).
Thoughts?
My splunk and apache configs looks like this:
in apache ssl.conf:
ProxyPass http://127.0.0.1:8000/splunk
ProxyPassReverse http://127.0.0.1:8000/splunk
in web.conf
root_endpoint = /splunk
tools.proxy.on = True
Ok, figured out a solution. This does appear to be a splunk weirdness, but one can get around it by adding AllowEncodedSlashes On to your vhost for :80. Will allow you to parse the doubly quoted path. I already have http redirecting to https and the rest just worked.