Has anyone experienced continuous automatic refreshing of Splunk (web console) dashboard or apps including searching.
When I visit Splunk console and try to navigate to any app or dashboard or even management console. It keeps refreshing every 2/3 seconds. I started noticing this behavior suddenly. I tried following
specifically, you might be seeing lines like so:
10-29-2019 11:07:25.865 -0700 ERROR UiAuth - Request from 10.209.0.34 to "/en-US/splunkd/__raw/servicesNS/someperson/someapp/search/jobs" failed CSRF validation -- expected "6641867248537937813", but instead cookie had "6641867248537937813" and header had "10543209232131847267"
from what I see, fixed in 7.2.10 and definitely fixed in 7.3 according to bug tracking
Try increasing connection timeout between the browser and Splunk web as below in web.conf and restart the Splunk instance:
server.socket_timeout = <integer> * The timeout, in seconds, for accepted connections between the browser and Splunk Web * Default: 10
server.socket_timeout = 60
This happens for us with Splunk when the SSO tokens expire as stated above. We need to refresh our tokens and get new windows. They refresh is maddening, especially since you could start to modify a search and then a refresh happens and you lose what you just typed.
If not just 'a dashboard' but 'all the screens of Splunk' are refreshing frequently, the first possibility is because of the SAML / SSO authentication. Please connect with your SAML provider team to check if your SSO is trying to refresh tokens frequently in your browser.
If it's only on the dashboard and not anywhere in Splunk, it is happening because of the refresh interval in the dashboard XML.
Splunk user interface keeps refreshing. Is anyone else having the same problem? If so, can you please provide assistance to have this matter resolved. Your help and feedback is greatly appreciated.
this might not be a problem of splunk, but the problem of your webbrowser.
What you describe is actually a problem that already happened with browsers before.
Just google "How do I stop name of your browser from refreshing pages constantly? "
I get this problem as well. It only seems to happen with Splunk dashboards or Searches; other web-pages are not getting refreshed. It seems to be limited to Splunk pages.
This is annoying when it gets into this mode. Sometimes I can simply copy the URI, close the tab, open a new tab and paste in the URI and it is ok. But I'd rather not do that.
Here is an update to what I am seeing.
I just got into the refresh behavior again. This time I made it go away by closing down a lot of tabs in my browser window. I had ~20+ tabs open in each of 3 separate Chrome windows (don't judge me). Once I closed a bunch of tabs the refresh problem stopped happening.
Yes, I have too many tabs open. But refreshing Splunk windows doesn't seem like it should be happening either.
Thanks for the comment. I do not experience this behavior for other sites Also my team mates has same experience on his laptop and browser.
I have another Splunk Instance (similar config but used for staging/test with few events). This one seems fine.
Also if it helps, auto refreshing is aggressive initially when page is loading to calms down as the page gets loaded in few minutes.