topic Re: Splunk links without language locale leads to broken urls in Splunk Enterprise

Splunk links without language locale leads to broken urls

Sahansral — Wed, 23 Jul 2025 10:34:54 GMT

Hello Community,

when we try to open a link to a Splunk Url without language setting, e.g. via the "Show results"-link in an email alert like https://our-splunk-address/app/some-app/alert?s=some-alert the request gets redirected automatically to something like https://our-splunk-address/de/app/some-app/alert?s=some-alert
which does not work. The Url should be https://our-splunk-address/de-DE/app/some-app/alert?s=some-alert
(see Configure user language and locale | Splunk Docs)

This incorrect redirect only happens in our productive environment and only if the language setting of the browser is set to german. English works fine (redirect is .../en-GB/...) We tested different browsers (Edge, Firefox) with same results.

Our test environment uses the same browsers, redirects correctly and we can't fathom any configurations differences between our test and production that could explain this bevaviour.

Did you experience a similar phenomenen or can give me a hint where I can look for further clues?

Regards,
Jens

Re: Splunk links without language locale leads to broken urls

livehybrid — Wed, 23 Jul 2025 11:00:49 GMT

Hi @Sahansral

Have you set any local user-prefs.conf changes? Please could you run the following:

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug

In the [general] stanza do you have a "lang" setting? There is no default so it could be missing but if its there it should be a valid lang value (e.g. "de-DE" not "de")

lang = <string> * Specifies the per-user language preference for non-web ui operations, where multiple tags are separated by commas. * If unset, English "en-US" is used when required. * Only tags used in the "Accept-Language" HTTP header are allowed, such as "en-US" or "fr-FR". * Fuzzy matching is supported, where "en" will match "en-US". * Optional quality settings are supported, such as "en-US,en;q=0.8,fr;q=0.6" * No default.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk links without language locale leads to broken urls

Sahansral — Thu, 24 Jul 2025 03:42:05 GMT

Hi livehybrid,

checked our test and production environment. Neither of them have a lang-setting.

Re: Splunk links without language locale leads to broken urls

thahir — Thu, 24 Jul 2025 07:53:46 GMT

Hi @Sahansral ,

Please try to execute the below btool command on the SH

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug

then output should be like below

/opt/splunk/etc/users/someuser/user-prefs/local/user-prefs.conf [general]
lang = de

if you find

lang = de

thats the actual problem- splunk will try to redirect /de/ even though it should be /de-DE/, and /de/ doesnt exist.

so try to update the below in the local if the issue persists for all the user

$SPLUNK_HOME/etc/system/local/user-prefs.conf

[general]
lang = de-DE

and restart splunk once.

note: if the issue is only for specific user then you need to change in the user level.

Please let me know if its worked.

Happy Splunking!!

Re: Splunk links without language locale leads to broken urls

Sahansral — Thu, 24 Jul 2025 09:25:47 GMT

Hi thahir,

the btool output doesn't find any lang-setting.

I think Splunk tries to honor the language preference of the browser.
When we change to english language in the browser, en-GB is added correctly into the link and the link works just fine.

In our browser (e.g. MS Edge) we have multiple language packs installed. There's one name "German (Germany)" and another one called "German".

I tested different languages. Our test environment can handle all of them. Our production messes up when we use language pack "German" without the country in brackets.