topic Re: Sometimes searches are not running on iPad in Splunk Search

Sometimes searches are not running on iPad

haph — Tue, 08 Jul 2025 12:56:23 GMT

Hi, we use iPads in our production area to display Splunk dashboards. The dashboards are classic ones with enhanced JS/CSS functionallity but standard dashboard searches.

We have the issue, that sometimes the searches are not run. When we inspect the console/network within safari dev settings, the request is sent but after 50ms an error occurs and no response is received. If we try again, mostly the search runs as expected.

On Windows devices those problems never occured.

Our network department says there are no network issues.

Anybody have a similar problem?

Thanks!

Re: Sometimes searches are not running on iPad

PrewinThomas — Wed, 09 Jul 2025 07:09:13 GMT

@haph

Could you try using Dashboard Studio? Some custom CSS or JavaScript used in Classic dashboards may not work well with Safari/iOS

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Sometimes searches are not running on iPad

bowesmana — Wed, 09 Jul 2025 07:16:07 GMT

Does the error give any indication what's going on?

Re: Sometimes searches are not running on iPad

haph — Wed, 09 Jul 2025 07:42:58 GMT

Unfortunenatly not. It's also not really an error. Just no response from the server after the request with the search string.

Re: Sometimes searches are not running on iPad

haph — Wed, 09 Jul 2025 07:46:12 GMT

No I can't try this because we need the custom styling and behaviour for this use case. We can't do that in dashboard studio. This is for user input --> Big buttons which, when pressed, 'send data' to splunk: A normal dashboard classic search is run with a collect command at the end. So no JS to run the searches, only for dashboard function.

Re: Sometimes searches are not running on iPad

bowesmana — Fri, 11 Jul 2025 00:02:04 GMT

ok, is there anything seen in the _audit index auditlog to see if the searches are actually received by Splunk

Re: Sometimes searches are not running on iPad

haph — Fri, 11 Jul 2025 05:45:31 GMT

The searches aren't received by Splunk Server.

We since checked the network traffic and there are TCP resets when the search is not received in server. I'll have an other meeting with our network guys to further investigate.

But I'm still wondering why this only happens with iOS/iPad. The Windows Laptops are in the same WiFi and even MacBooks don't have this issue. Only iPads. So I doubt it's something network related.

Re: Sometimes searches are not running on iPad

PrewinThomas — Fri, 11 Jul 2025 06:54:31 GMT

@haph
Can you try alternative browser(chrome/firefox) on your ipad and see how it works. This helps isolate whether Safari on iPad is the bottleneck.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Sometimes searches are not running on iPad

haph — Fri, 11 Jul 2025 07:06:11 GMT

Chrome on iPad has the same issues, tested yesterday.

My teammate just now tried using it via VPN from his home office. And he couldn't recreate the issue! So I start to believe it's the company's WiFis fault. Will check with our network guys.