Building for the Splunk Platform

Splunk Bookmarks not working in Firefox and Chrome

Path Finder

Our users use several dashboards we have in our app. They would like to have the ability to select filters on the dashboard, bookmark them, and navigate back to them later without having to reenter any filter values. Most of the filters on our dashboards are multiselect fields with a default value of: name="All" value=".*"

Currently, we can set filters and bookmark a page. Unfortunately, when navigating to that bookmark in a fresh browser session, we have 2 main problems:
1. Our custom css and js does not get applied to the dashboard
2. Out multiselects are not populated correctly with the default values

1. Navigate to a dashboard with multiselect fields. Select a value where name="All" and value=".*"
2. Bookmark that page
3. Close firefox
4. Open a new private browsing session
5. Navigate to the saved bookmark
At this point, the multiselect field will be populated with ".%2A" instead of "All". Also, none of the custom js/css will be applied. If I open up the debug console, it looks like the domain is wrong for the URL of the JS/CSS (with a 307 error). It uses "splunk" as the domain instead of what it should use.
Bookmark loads this: https://splunk/en-US/static/@03bbabcabf43/app/testApp/dashboard.css
Instead of this: https://local.test/en-US/static/@03bbabcabf43/app/testApp/dashboard.css

If I refresh the page, all of the JS/CSS loads properly, but the multiselect fields are still incorrect.
If I click the bookmark again, everything looks just fine. JS/CSS loads correctly and the multiselects populate with "All"
If I use bookmarks in IE, it works fine. JS/CSS loads properly and multiselects populate with "All"

Environment information:
Splunk version: 7.1.2
Browser: Firefox (various versions), Chrome (various versions)
Relevant architecture info: Splunk search head cluster (3 members) behind a load balancer

Is there something I have to do to get bookmarks to work? Our users are not motivated enough to click a bookmark twice to get it to load correctly

0 Karma

Path Finder

I figured out a work around for the .%2A problem.
In my search, I just added an eval statement to convert %2A to .* The below statement checks my multiselect for %2A, , or All and sets matcher to . if they match. If not, just use what is in the multiselect.

| eval matcher = if(match($multiselect1$, "\((\*|\.?%2A|All)\)"), ".*", $multiselect1$)
| where match(field, matcher)

I still have the 307 error problem with my js and css the first time I navigate to my bookmark in a fresh browsing session (like in private or incognito). Any suggestions would help!

0 Karma

Path Finder

Another update:

This error only occurs if I save a bookmark with filters selected.
For example, if I save a bookmark like this, it works fine (JS/CSS applied correctly):


If I save a bookmark with filters selected, I get the 307 error where it can't find my JS/CSS because it is using the wrong domain

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...