topic How to remove Splunk login page iframe? in Security

How to remove Splunk login page iframe?

dcascione — Thu, 04 Feb 2016 16:01:32 GMT

Hello! I would like to understand what content should be displayed in the login page iframe and also how to remove it permanently (currently displaying an error). Any help would be greatly appreciated - Thanks!

Re: How to remove Splunk login page iframe?

lycollicott — Thu, 04 Feb 2016 18:27:14 GMT

This isn't much to go on. What's your browser? What's in your web.conf? Specifically the login_content line?

Re: How to remove Splunk login page iframe?

dcascione — Thu, 04 Feb 2016 19:00:49 GMT

Hello - For some reason the description I added along with the photo isn't showing - my apologies. Basically I want to know where the login page is located on the Splunk Enterprise Search Head and how to remove the iframe imbedded in the page. Right now its displaying the error finding the page to fill the iframe. We are currently using IE11. Thanks!

Re: How to remove Splunk login page iframe?

lycollicott — Thu, 04 Feb 2016 19:35:35 GMT

I believe that is dynamically generated content by a combination of json, js and css.

Do you have a "login_content" line in either system/default/\web.conf or system/local/web.conf ?

That line specifies what is to be auto generated and your screen shot sort of looks like "login_content" might be set something invalid.

Re: How to remove Splunk login page iframe?

dcascione — Thu, 04 Feb 2016 20:03:33 GMT

Found the line in systems/default/web.conf

Custom content for login screen

login_content =

Tried to comment out the reference and reboot the system with no change.

Re: How to remove Splunk login page iframe?

dcascione — Thu, 04 Feb 2016 20:09:38 GMT

changed to login_content = false and now I see the word "false" above the blank iframe!

Re: How to remove Splunk login page iframe?

lycollicott — Tue, 29 Sep 2020 08:41:10 GMT

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

Re: How to remove Splunk login page iframe?

dcascione — Fri, 05 Feb 2016 18:56:21 GMT

Yes! Navigating here: share/splunk/search_mrsparkle/exposed/js/login.js

I changed the url from "http://www.splunk.com/r/download" to just "" and it resolved the issue.

template: '\
                <a href="http://www.splunk.com/r/download" class="btn"><%= _("Download").t() %></a>\
                <a href="#" class="skip"><%= _("Skip update").t() %></a>\

Thanks!

Re: How to remove Splunk login page iframe?

chris24747 — Mon, 08 Feb 2016 11:16:29 GMT

Hi, no need for hacking js files, it's an option in web.conf:

updateCheckerBaseURL = http://quickdraw.Splunk.com/js/

Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself.

so :
[settings]
updateCheckerBaseURL=0

Re: How to remove Splunk login page iframe?

dcascione — Mon, 08 Feb 2016 15:55:02 GMT

Thanks for the alternate answer. I reverted my changes and updated the [settings] option as you described above!