In the app navigation menu, the area where you can switch between apps, all of the menu icons are broken. Instead of showing the small image, it shows a text box that says "menu icon." I have attached an image of this. Please note that this is for all apps as well, not just search & reporting.
Does anyone have any insight on where this error might be at? How to fix this?
regarding your comment "for my system, we use nginx on the system", I believe the issue is to do with sticky/persistent sessions within nginx that Splunk needs to run correctly. If you use "ip hash;" within your nginx.conf file this should resolve the issue.
The reason for this is that once you log in the session, the "login cookies" are not sent over with the session.
So instead of having:
you will get something like:
Struggled for 2-3 hours. Figured out the static folder needs to be placed out on the parent app folder rather than the appserver folder. Works fine with correct resolution PNG files.
Just to add more info here... I'm getting a "500 Internal Server Error" when I try to bring up the icons directly using the paths shown previously.
Howdy everyone -
I'm having this exact same issue with a Splunk 7.1.2 installation.
I've tried the troubleshooting steps suggested below, including resetting the owner and group on the files, and resetting the permissions for the apps. I'm unable to bring up the app icons directly using the paths that were shown in the discussion from back in 2015.
I seem to be seeing an error finding the path, or in permissions to get to the icons.
Is there a log file I should be able to find some more data in as to the failure to send my browser the icons?
Oh, one more comment here - for my system, we use nginx on the system and must pass through it for authentication to the site. If that factors in, happy to look in appropriate paths for troubleshooting there too.
I ran into this same missing icon today and found that can be part of a capability that has been split out.
To see those icons users roles must have "rest_properties_get" somewhere.
That resolved the issue for me also
Thanks Lucas. Granting the user role "rest_properties_get" capability resolved this issue for me.
In your favorite Browser, open this tab:
http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png or http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt_2x.png
Do you see an icon in the browser? If you do NOT, then check file permissions on the searchheads. The images must be readable by Splunk.
If you do see the icon in the browser, there is something more sinister afoot. Don't forget to check the Network calls in the Developer Tools of the Browser, you might be able to see where it is breaking.
It's possible. Can you
ls -la the folder
$SPLUNK_HOME/etc/apps/search/appserver/static? post the results?
Copy the images from the search head to your local system, and see if they render correctly.
/opt/splunk/etc/apps/search/static # ls -la total 24 drwxr-xr-x 2 splunk splunk 4096 Sep 1 16:35 . drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 .. -r--r--r-- 1 root root 437 Sep 1 16:35 appIcon.png -r--r--r-- 1 root root 444 Sep 1 16:35 appIconAlt.png -r--r--r-- 1 root root 735 Sep 1 16:35 appIconAlt_2x.png -r--r--r-- 1 root root 734 Sep 1 16:35 appIcon_2x.png
They also will not open in my windows machine.
Right, ok. So let's start with permissions.
chown -R splunk: /opt/splunk/etc/apps. This will reset owner and group to
This will reload the images and break any caches.
I'm also on IRC #splunk on Efnet.org if you wanna chat in realtime.
Oh, and do a
chmod -R 755 /opt/splunk/etc/apps just to make sure.
I am still having the same issue after issuing these commands.
I have bumped the version.
Does not load.
Adding to the conversation down here to see if I can keep it straight better... same issue here, and did confirm that rest_properties_get is granted...
Permissions look like this:
drwxr-xr-x. 2 splunk splunk 4096 Aug 13 16:05 .
drwxr-xr-x. 10 splunk splunk 4096 Jul 10 00:28 ..
-rwxr-xr-x. 1 splunk splunk 3556 Jul 9 23:26 appIcon_2x.png
-rwxr-xr-x. 1 splunk splunk 2547 Jul 9 23:26 appIconAlt_2x.png
-rwxr-xr-x. 1 splunk splunk 1981 Jul 9 23:26 appIconAlt.png
-rwxr-xr-x. 1 splunk splunk 3167 Jul 9 23:26 appIcon.png
/opt/splunk/etc/apps/search/static # ls -la
drwxr-xr-x 2 splunk splunk 4096 Sep 1 16:35 .
drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 ..
-r--r--r-- 1 root root 437 Sep 1 16:35 appIcon.png
-r--r--r-- 1 root root 444 Sep 1 16:35 appIconAlt.png
-r--r--r-- 1 root root 735 Sep 1 16:35 appIconAlt_2x.png
-r--r--r-- 1 root root 734 Sep 1 16:35 appIcon_2x.png
I also have moved the icons over to my local windows machine and windows photo viewer is not able to view them.
Thanks for the quick reply.
I went to the links you provided and I received the following:
"The image "https:///en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png" cannot be displayed because it contains errors.
Do you think this is a permission issue?