Splunk 6.6.0 not working with IE11 and DNS Name

jlucius · ‎05-12-2017

Since Upgrading to Splunk 6.6.0 we cannot access Dashboard, Indexes ... (seems any submenu) when using Internet Explorer 11 and the DNS name of the Server. Strange thing is, it is working when using the IP address in the URL instead of the DNS name or it is working when using Firefox or Chrome browser with DNS name or IP. Any ideas on that?

runner724 · ‎06-26-2017

Our users on IE11 with the Compatibility Mode enforced were able to view Splunk prior to the 6.6 update. I conclude the issue is on the Splunk side. In our large enterprise environment the compatibility mode is set via GPO so I can't tell my users to change it as a workaround.

Scripting before the <meta http-equiv="X-UA-Compatible" content="IE=edge" /> directive causes it to be ignored. Per Microsoft documentation, The X-UA-Compatible header isn't case sensitive; however, it must appear in the header of the webpage (the HEAD section) before all other elements except for the title element and other meta elements. https://msdn.microsoft.com/en-us/library/jj676915(v=vs.85).aspx

Here is the top of the HTML generated when I visit a Splunk dashboard in IE11, demonstrating <meta http-equiv="X-UA-Compatible" content="IE=edge" /> being placed after scripting:

<!doctype html>
<!--[if lt IE 7]> <html lang="en" class="no-js ie  lt-ie9 lt-ie8 lt-ie7"> <![endif]-->
<!--[if IE 7]>    <html lang="en" class="no-js ie7 lt-ie9 lt-ie8"> <![endif]-->
<!--[if IE 8]>    <html lang="en" class="no-js ie8 lt-ie9"> <![endif]-->
<!--[if IE 9]>    <html lang="en" class="no-js ie9"> <![endif]-->
<!--[if gt IE 9]><!--> <html lang="en" class="no-js"> <!--<![endif]-->
<head>
        <meta name="referrer" content="never" />
        <meta name="referrer" content="no-referrer" />

          <script>
                window._splunk_metrics_events = {
                   push : function() {},
                   active: false,
                   }
          </script>

    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta charset="utf-8" />
    <title>Loading...</title>
    (rest of the source omitted)

Here are some simpler examples that demonstrate this issue.

If I visit this webpage in IE11 with the compatibility mode on, it renders in 'edge' (latest) document mode:

<!doctype html>
<html>
<head>
    <meta name="referrer" content="never" />
    <meta name="referrer" content="no-referrer" />
    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <title>Test - meta tags are proper</title>
    <script>
        console.log("logging something to the console");
    </script>
</head>
<body>
    Test - meta tags are proper
</body>
</html>

If I visit this webpage in IE11 with the compatibility mode on, it renders in IE7 document mode:

<!doctype html>
<html>
<head>
    <meta name="referrer" content="never" />
    <meta name="referrer" content="no-referrer" />
    <script>
        console.log("logging something to the console");
    </script>
    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <title>Test - meta tags are after some scripting</title>
</head>
<body>
    Test - meta tags are after some scripting
</body>
</html>

The only difference is the position of the script block.

arowsell_splunk · ‎05-23-2017

This matter I believe is caused by the IE Compatibility mode. To reproduce:

On IE 11 Login to Splunk 6.6.
In IE go to:

Settings --> Compatibility View Settings

Add the Splunk instance to the "Websites you've added to Compatibility View", do this by selecting "Add this website:"
Now in Splunk navigate to:

Settings --> Indexes

The page will not load. Other pages are also effected. If you go to the IE debugger you will see that the page is being rendered in IE 7 instead of IE 11.

The same does not occur on Splunk 6.5.x, the pages always default to IE 11 in Compatibility mode.

The following bug is open for this matter:

SPL-141947 - Splunk 6.6.0 and IE 11 compatibility mode

The current workaround is to disabled compatibility mode.

jlucius · ‎05-23-2017

To answer my own questions (Splunk support did point me in the right direction):

The Internet Explorer compatibility mode is causing this. I had the option "Display intranet sites in Compatibility View" enabled in IE 11 which causes my Splunk site to be displayed in compatiblility mode. IE does not recognize it as intranet site if the IP is used, so this is why it was working with the IP.

I am not sure if Splunk will fix this in Splunk, but If I get more information I will post them here.

rapmancz · ‎05-15-2017

In Explorer 11, I can see only Loading... and no dashboards... This happens on every PC with Internet Explorer. Firefox and Chrome is OK.

Splunk 6.6.0 not working with IE11 and DNS Name

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

Improve Data Pipelines Using Splunk Data Management

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?