Error in Chrome (across multiple deployments) when saving a view in Splunk.

[cschmidt_hurric]

Currently seeing this error in Chrome whenever I try to save a view in Splunk. This occurs across multiple deployments, some Splunk 7 and some Splunk 8. Does anyone know what causes this?

2020-05-28 16:19:14,606 ERROR   [5ed01cc296109d50c90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26024, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://localhost:8000/en-US/static/@8F68C924E96E41B2D0294AE7995C1485D1FCAADD28E0AE1AE0C13C6BAE57A9EA/js/common.min.js

[cschmidt_hurric]

Chrome 83.0.4103.97 appears to fix this.

[acharlieh]

I had a coworker point this one out to me, similar error message, around lookup table upload, on Chrome version 83.0.4103.61 with MacOS Catalina 10.15.4 (19E287).. But then Chrome updated to 83.0.4103.97 and reloaded and the error went away for me...

[cschmidt_hurric]

I can confirm Chrome 83.0.4103.97 fixes this issue for me.

[gavins_k1]

Oohhh that's promising, thank you for the info!! I have already lost 2 days to this, and have switched over to FireFox, but will test as soon as I get the chance.

[gavins_k1]

the test results are in...

TL;DR; version
- From my messing around - trying to make apps in chrome doesn't work as expected with SSL on the webui
- Does not happen in FireFox

Long Version
The test setup is as follows

Server:
- New VM running updated, latest, CentOS 8
- Splunk 8.0.4

Certs Used:
- Splunk defaults. The self signed certs created when Splunk starts
- Certs created by testing ca (using XCA):
mywebui.pem cert file contains server, intermediate, and root ca certs as a chain, in that order
mywebui.key key file containing unencrypted private key for mywebui.pem
mysplunkd.pem cert file contains serve, encrypted private key, int ca, root ca, in that order
myrootca.pem cert file contains only the root ca cert (not the int ca)
- all certs installed in $SPLUNK_HOME/etc/auth and only adding/changing config in $SPLUNK_HOME/etc/system/local for simplicity

Client:
- Win10
- Chrome 83.0.4103.61
- Firefox 77.0.
- Only the internal root CA has been installed into Windows and Firefox.
- Browsers were restarted before and after every test, and private windows/incognito mode were used to keep cookies and cache getting in the way.

Test Method
Create a new app using webui, using the sample_app template.
Use Splunk search index=_internal sourcetype=splunk_web_service log_level=error to look for errors

Test, no SSL
No problems for both browsers, no errors in Splunk from above search.

Test with Splunk default cert
created web.conf

[settings]
enableSplunkWebSSL = true

Chrome: When click "Save" on add new app, page hangs with button on 'Saving...'. Refresh shows that app is created.
Error in Splunk:

2020-06-03 19:33:48,842 ERROR [5ed76e7cd37fe63d913b90] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js`

FireFox: No problems, or errors.

Test with own certs
updated web.conf

[settings]
enableSplunkWebSSL = true
privKeyPath = $SPLUNK_HOME/etc/auth/mywebui.key
serverCert = $SPLUNK_HOME/etc/auth/mywebui.pem

updated server.conf

[sslConfig]
caCertFile = $SPLUNK_HOME/etc/auth/myrootca.pem
serverCert = $SPLUNK_HOME/etc/auth/mysplunkd.pem
sslPassword = it-is-not-a-problem-the-password-is-correct

Chrome: Trusted in browser, same behavior as default ssl test, page hangs, app created in background
Error in Splunk:

2020-06-03 20:01:29,059 ERROR [5ed774f90a7fa16bf98d10] utility:58 - name=javascript, class=Splunk.Error, lineNumber=26103, message=Uncaught TypeError: Cannot read property 'status' of null, fileName=https://<>:8000/en-GB/static/@1CA1401A03689AC76EC0FD8820202120C1384DA1951537830BBAC1E85DE4DC2B/js/common.min.js

FireFox: Trusted in browser, no problems, or errors.

conclusion
throw out chrome? use firefox? :shurg:

Hope all this helps.

[cschmidt_hurric]

Tried upgrading to Chrome 84 (beta). Issue still present.

[alanprescott2]

Indeed many thanks

[cschmidt_hurric]

Thank you for your investigation!

[yaasirvatham_sp]

@gavins_k1 We reproduced this and it is working fine without any issues.
It is working with Chrome Version 81.0.4044.129 (Official Build) (64-bit)

[gavins_k1]

nice, alas it looks like you are not on the latest version of chrome... 83.0.4103.61 > 81.0.4044.129

i ran though the above tests 4 times as i thought i was going crazy, it makes no sense.
a new vm install and splunk install every time..

[alanprescott2]

I have Version 83.0.4103.61 (Official Build) (64-bit), so its not working for you on this version but it is on 81.0.4044.129

[yaasirvatham_sp]

What is the exact Splunk version? is it SH?

[alanprescott2]

Splunk Enterprise Version: 7.3.1 Build:bd63e13aa157

[gavins_k1]

mine is 8.0.4 on a standalone test machine. I've been doing some testing, and the rabbit hole so far is leading me to something SSL on the WubUI related... just a hunch at the moment, will report back with something more concrete when I have it.

[cschmidt_hurric]

Yes I can confirm this occurs only when my search head is using SSL. We also have reports of some users having issues with Firefox as well, but they're more intermittent.