topic Re: Splunk Bookmarks not working in Firefox and Chrome in Splunk Dev

Splunk Bookmarks not working in Firefox and Chrome

eroffol — Tue, 18 Sep 2018 19:16:18 GMT

Overview
Our users use several dashboards we have in our app. They would like to have the ability to select filters on the dashboard, bookmark them, and navigate back to them later without having to reenter any filter values. Most of the filters on our dashboards are multiselect fields with a default value of: name="All" value=".*"

Currently, we can set filters and bookmark a page. Unfortunately, when navigating to that bookmark in a fresh browser session, we have 2 main problems:
1. Our custom css and js does not get applied to the dashboard
2. Out multiselects are not populated correctly with the default values

Reproducing:
1. Navigate to a dashboard with multiselect fields. Select a value where name="All" and value=".*"
2. Bookmark that page
3. Close firefox
4. Open a new private browsing session
5. Navigate to the saved bookmark
At this point, the multiselect field will be populated with ".%2A" instead of "All". Also, none of the custom js/css will be applied. If I open up the debug console, it looks like the domain is wrong for the URL of the JS/CSS (with a 307 error). It uses "splunk" as the domain instead of what it should use.
Example:
Bookmark loads this: https://splunk/en-US/static/@03bbabcabf43/app/testApp/dashboard.css
Instead of this: https://local.test/en-US/static/@03bbabcabf43/app/testApp/dashboard.css

If I refresh the page, all of the JS/CSS loads properly, but the multiselect fields are still incorrect.
If I click the bookmark again, everything looks just fine. JS/CSS loads correctly and the multiselects populate with "All"
If I use bookmarks in IE, it works fine. JS/CSS loads properly and multiselects populate with "All"

Environment information:
Splunk version: 7.1.2
Browser: Firefox (various versions), Chrome (various versions)
Relevant architecture info: Splunk search head cluster (3 members) behind a load balancer

Is there something I have to do to get bookmarks to work? Our users are not motivated enough to click a bookmark twice to get it to load correctly

Re: Splunk Bookmarks not working in Firefox and Chrome

eroffol — Thu, 27 Sep 2018 18:08:17 GMT

I figured out a work around for the .%2A problem.
In my search, I just added an eval statement to convert %2A to .* The below statement checks my multiselect for %2A, , or All and sets matcher to . if they match. If not, just use what is in the multiselect.

| eval matcher = if(match($multiselect1$, "\((\*|\.?%2A|All)\)"), ".*", $multiselect1$)
| where match(field, matcher)

I still have the 307 error problem with my js and css the first time I navigate to my bookmark in a fresh browsing session (like in private or incognito). Any suggestions would help!

Re: Splunk Bookmarks not working in Firefox and Chrome

eroffol — Tue, 02 Oct 2018 14:53:20 GMT

Another update:

This error only occurs if I save a bookmark with filters selected.
For example, if I save a bookmark like this, it works fine (JS/CSS applied correctly):

https://local.test/splunk/en-US/app/testApp/testDashboard

If I save a bookmark with filters selected, I get the 307 error where it can't find my JS/CSS because it is using the wrong domain

https://local.test/splunk/en-US/app/testApp/testDashboard?form.filter1="All"&form.filter2=".*";