@rtvnguyen, Splunk web interface uses two HTTP 303 redirects if you point to http://127.0.0.1:8000. http://127.0.0.1:8000/en-US  http://127.0.0.1:8000/en-US/account/login?return_to=%2Fen-US%2F These redirects goes HTTPS or HTTP according to Splunk web.conf, ssl enabled or not. Your Splunk seems not working SSL enabled. That is why redirecting you http://127.0.0.1:8000/en-US/. You have three options; 1- Point your SSH Tunnel as http://localhost:9002 2- Edit Splunk web.conf to enable SSL and restart. 3- Use direct link https://localhost:9002/en-US/account/login?return_to=%2Fen-US%2F  Best Regards,  ... View more