topic Re: Error in Chrome (across multiple deployments) when saving a view in Splunk. in Dashboards & Visualizations

Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Sun, 07 Jun 2020 23:30:19 GMT

Currently seeing this error in Chrome whenever I try to save a view in Splunk. This occurs across multiple deployments, some Splunk 7 and some Splunk 8. Does anyone know what causes this?

2020-05-28 16:19:14,606 ERROR   [5ed01cc296109d50c90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26024, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://localhost:8000/en-US/static/@8F68C924E96E41B2D0294AE7995C1485D1FCAADD28E0AE1AE0C13C6BAE57A9EA/js/common.min.js

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

yaasirvatham_sp — Wed, 03 Jun 2020 06:28:08 GMT

What is the exact Splunk version? is it SH?

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

gavins_k1 — Wed, 03 Jun 2020 06:52:25 GMT

mine is 8.0.4 on a standalone test machine. I've been doing some testing, and the rabbit hole so far is leading me to something SSL on the WubUI related... just a hunch at the moment, will report back with something more concrete when I have it.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

alanprescott2 — Wed, 03 Jun 2020 08:55:40 GMT

Splunk Enterprise Version: 7.3.1 Build:bd63e13aa157

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

gavins_k1 — Wed, 30 Sep 2020 05:37:19 GMT

the test results are in...

TL;DR; version
- From my messing around - trying to make apps in chrome doesn't work as expected with SSL on the webui
- Does not happen in FireFox

Long Version
The test setup is as follows

Server:
- New VM running updated, latest, CentOS 8
- Splunk 8.0.4

Certs Used:
- Splunk defaults. The self signed certs created when Splunk starts
- Certs created by testing ca (using XCA):
mywebui.pem cert file contains server, intermediate, and root ca certs as a chain, in that order
mywebui.key key file containing unencrypted private key for mywebui.pem
mysplunkd.pem cert file contains serve, encrypted private key, int ca, root ca, in that order
myrootca.pem cert file contains only the root ca cert (not the int ca)
- all certs installed in $SPLUNK_HOME/etc/auth and only adding/changing config in $SPLUNK_HOME/etc/system/local for simplicity

Client:
- Win10
- Chrome 83.0.4103.61
- Firefox 77.0.
- Only the internal root CA has been installed into Windows and Firefox.
- Browsers were restarted before and after every test, and private windows/incognito mode were used to keep cookies and cache getting in the way.

Test Method
Create a new app using webui, using the sample_app template.
Use Splunk search index=_internal sourcetype=splunk_web_service log_level=error to look for errors

Test, no SSL
No problems for both browsers, no errors in Splunk from above search.

Test with Splunk default cert
created web.conf

[settings]
enableSplunkWebSSL = true

Chrome: When click "Save" on add new app, page hangs with button on 'Saving...'. Refresh shows that app is created.
Error in Splunk:

2020-06-03 19:33:48,842 ERROR [5ed76e7cd37fe63d913b90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js`

FireFox: No problems, or errors.

Test with own certs
updated web.conf

[settings]
enableSplunkWebSSL = true
privKeyPath = $SPLUNK_HOME/etc/auth/mywebui.key
serverCert = $SPLUNK_HOME/etc/auth/mywebui.pem

updated server.conf

[sslConfig]
caCertFile = $SPLUNK_HOME/etc/auth/myrootca.pem
serverCert = $SPLUNK_HOME/etc/auth/mysplunkd.pem
sslPassword = it-is-not-a-problem-the-password-is-correct

Chrome: Trusted in browser, same behavior as default ssl test, page hangs, app created in background
Error in Splunk:

2020-06-03 20:01:29,059 ERROR [5ed774f90a7fa16bf98d10] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js

FireFox: Trusted in browser, no problems, or errors.

conclusion
throw out chrome? use firefox? :shurg:

Hope all this helps.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

yaasirvatham_sp — Wed, 03 Jun 2020 12:14:49 GMT

@gavins_k1 We reproduced this and it is working fine without any issues.
It is working with Chrome Version 81.0.4044.129 (Official Build) (64-bit)

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

gavins_k1 — Wed, 03 Jun 2020 14:36:36 GMT

nice, alas it looks like you are not on the latest version of chrome... 83.0.4103.61 > 81.0.4044.129

i ran though the above tests 4 times as i thought i was going crazy, it makes no sense.
a new vm install and splunk install every time..

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

alanprescott2 — Wed, 03 Jun 2020 15:41:08 GMT

I have Version 83.0.4103.61 (Official Build) (64-bit), so its not working for you on this version but it is on 81.0.4044.129

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Wed, 03 Jun 2020 16:20:09 GMT

Thank you for your investigation!

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

alanprescott2 — Wed, 03 Jun 2020 16:24:29 GMT

Indeed many thanks

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Wed, 03 Jun 2020 17:30:19 GMT

Tried upgrading to Chrome 84 (beta). Issue still present.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

acharlieh — Wed, 03 Jun 2020 18:52:16 GMT

I had a coworker point this one out to me, similar error message, around lookup table upload, on Chrome version 83.0.4103.61 with MacOS Catalina 10.15.4 (19E287).. But then Chrome updated to 83.0.4103.97 and reloaded and the error went away for me...

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Wed, 03 Jun 2020 21:15:19 GMT

Yes I can confirm this occurs only when my search head is using SSL. We also have reports of some users having issues with Firefox as well, but they're more intermittent.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

gavins_k1 — Wed, 03 Jun 2020 23:48:48 GMT

Oohhh that's promising, thank you for the info!! I have already lost 2 days to this, and have switched over to FireFox, but will test as soon as I get the chance.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Thu, 04 Jun 2020 14:01:18 GMT

I can confirm Chrome 83.0.4103.97 fixes this issue for me.

Re: Error in Chrome (across multiple deployments) when saving a view in Splunk.

cschmidt_hurric — Thu, 04 Jun 2020 14:01:33 GMT

Chrome 83.0.4103.97 appears to fix this.