It is disappointing that Splunk does not provide this capability out of the box. You would expect this from the tools.proxy.base setting but it just keeps pointing back to localhost:8000. So, to resolve termination of HTTPS traffic on my ELB and pass HTTP to the instance,  I had to do add a reverse proxy. It is an overkill unfortunately @fman82 but easy to setup. In short, I added Nginx and setup a redirection of all 80 traffic to 443 using the following configuration: server {   listen 80 default_server;   listen [::]:80 default_server;   server_name <elb.hostname.domain>;   return 301 https://$host$request_uri; } Keep in mind you may need to open port 80 on the ELB and all the internal HTTP Splunk redirects are handled by Nginx. ... View more

I'm having the same issue. The tools.proxy.base configuration does not seem to be working as it always points to 127.0.0.1:8000, it does not matter what I add as a base. tools.proxy.on = <boolean> * Whether or not the Splunk platform instance is behind a reverse proxy server. * If set to "true", the instance assumes that it is behind a reverse proxy and uses HTTP header information from the proxy to log access requests, secure its cookies properly, and generate valid URLs for redirect responses. * All of the instance's HTTP services will use information from "X-Forwarded-*", "Front-End-Https", and "X-Url-Scheme" headers, where available, to override what it receives from proxied requests. * If you set this to "true", you must also set 'tools.proxy.base' to a valid host name and network port. * If set to "false", the instance relies on its own internal HTTP server settings and the immediate client's HTTP headers for the information needed for access request logging, cookie securing, and redirect URL generation. * Default: false tools.proxy.base = <scheme>://<URL> * The proxy base URL in Splunk Web. * Default: empty string   ... View more

The following works better rex field=Message "Subject:[\s]+?Security ID:[\s]+(?<myfield1>\S+)[\s\S]+?New Account:[\s]+?Security ID:[\s]+(?<myfield2>\S+)" ... View more