Dashboards & Visualizations

Error in Chrome (across multiple deployments) when saving a view in Splunk.

Path Finder

Currently seeing this error in Chrome whenever I try to save a view in Splunk. This occurs across multiple deployments, some Splunk 7 and some Splunk 8. Does anyone know what causes this?

2020-05-28 16:19:14,606 ERROR   [5ed01cc296109d50c90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26024, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://localhost:8000/en-US/static/@8F68C924E96E41B2D0294AE7995C1485D1FCAADD28E0AE1AE0C13C6BAE57A9EA/js/common.min.js
Labels (1)

Path Finder

Chrome 83.0.4103.97 appears to fix this.

0 Karma

Influencer

I had a coworker point this one out to me, similar error message, around lookup table upload, on Chrome version 83.0.4103.61 with MacOS Catalina 10.15.4 (19E287).. But then Chrome updated to 83.0.4103.97 and reloaded and the error went away for me...

0 Karma

Path Finder

I can confirm Chrome 83.0.4103.97 fixes this issue for me.

0 Karma

Path Finder

Oohhh that's promising, thank you for the info!! I have already lost 2 days to this, and have switched over to FireFox, but will test as soon as I get the chance.

0 Karma

Path Finder

the test results are in...

TL;DR; version
- From my messing around - trying to make apps in chrome doesn't work as expected with SSL on the webui
- Does not happen in FireFox

Long Version
The test setup is as follows

Server:
- New VM running updated, latest, CentOS 8
- Splunk 8.0.4

Certs Used:
- Splunk defaults. The self signed certs created when Splunk starts
- Certs created by testing ca (using XCA):
mywebui.pem cert file contains server, intermediate, and root ca certs as a chain, in that order
mywebui.key key file containing unencrypted private key for mywebui.pem
mysplunkd.pem cert file contains serve, encrypted private key, int ca, root ca, in that order
myrootca.pem cert file contains only the root ca cert (not the int ca)
- all certs installed in $SPLUNKHOME/etc/auth and only adding/changing config in $SPLUNKHOME/etc/system/local for simplicity

Client:
- Win10
- Chrome 83.0.4103.61
- Firefox 77.0.
- Only the internal root CA has been installed into Windows and Firefox.
- Browsers were restarted before and after every test, and private windows/incognito mode were used to keep cookies and cache getting in the way.

Test Method
Create a new app using webui, using the sampleapp template.
Use Splunk search `index=
internal sourcetype=splunkwebservice log_level=error` to look for errors

Test, no SSL
No problems for both browsers, no errors in Splunk from above search.

Test with Splunk default cert
created web.conf

[settings]
enableSplunkWebSSL = true

Chrome: When click "Save" on add new app, page hangs with button on 'Saving...'. Refresh shows that app is created.
Error in Splunk:

2020-06-03 19:33:48,842 ERROR [5ed76e7cd37fe63d913b90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js`

FireFox: No problems, or errors.

Test with own certs
updated web.conf

[settings]
enableSplunkWebSSL = true
privKeyPath = $SPLUNKHOME/etc/auth/mywebui.key
serverCert = $SPLUNK
HOME/etc/auth/mywebui.pem

updated server.conf

[sslConfig]
caCertFile = $SPLUNKHOME/etc/auth/myrootca.pem
serverCert = $SPLUNK
HOME/etc/auth/mysplunkd.pem
sslPassword = it-is-not-a-problem-the-password-is-correct

Chrome: Trusted in browser, same behavior as default ssl test, page hangs, app created in background
Error in Splunk:

2020-06-03 20:01:29,059 ERROR [5ed774f90a7fa16bf98d10] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js

FireFox: Trusted in browser, no problems, or errors.

conclusion
throw out chrome? use firefox? :shurg:

Hope all this helps.

Path Finder

Tried upgrading to Chrome 84 (beta). Issue still present.

0 Karma

New Member

Indeed many thanks

0 Karma

Path Finder

Thank you for your investigation!

0 Karma

Splunk Employee
Splunk Employee

@gavins_k1 We reproduced this and it is working fine without any issues.
It is working with Chrome Version 81.0.4044.129 (Official Build) (64-bit)

0 Karma

Path Finder

nice, alas it looks like you are not on the latest version of chrome... 83.0.4103.61 > 81.0.4044.129

i ran though the above tests 4 times as i thought i was going crazy, it makes no sense.
a new vm install and splunk install every time..

0 Karma

New Member

I have Version 83.0.4103.61 (Official Build) (64-bit), so its not working for you on this version but it is on 81.0.4044.129

0 Karma

Splunk Employee
Splunk Employee

What is the exact Splunk version? is it SH?

0 Karma

New Member

Splunk Enterprise Version: 7.3.1 Build:bd63e13aa157

0 Karma

Path Finder

mine is 8.0.4 on a standalone test machine. I've been doing some testing, and the rabbit hole so far is leading me to something SSL on the WubUI related... just a hunch at the moment, will report back with something more concrete when I have it.

0 Karma

Path Finder

Yes I can confirm this occurs only when my search head is using SSL. We also have reports of some users having issues with Firefox as well, but they're more intermittent.

0 Karma