How to fix broken Menu Icons in the app navigation drop-down menu?

[mmensch]

Hello,

In the app navigation menu, the area where you can switch between apps, all of the menu icons are broken. Instead of showing the small image, it shows a text box that says "menu icon." I have attached an image of this. Please note that this is for all apps as well, not just search & reporting.

The problem here is that multiple people work on the same Splunk Instance and new JavaScript & CSS are constantly being added. No one noticed when this first happened, so we cannot track it back to where it happened.

Does anyone have any insight on where this error might be at? How to fix this?

Thanks

[sysjohn]

Hello,

regarding your comment "for my system, we use nginx on the system", I believe the issue is to do with sticky/persistent sessions within nginx that Splunk needs to run correctly. If you use "ip hash;" within your nginx.conf file this should resolve the issue.

The reason for this is that once you log in the session, the "login cookies" are not sent over with the session.

So instead of having:

"/en-US/splunkd/_raw/servicesNS/AUTHENTICATEDUSER/search/static/appIconAlt.png"

you will get something like:

"/en-US/splunkd/_raw/servicesNS/undefined/search/static/appIconAlt.png".

[linu1988]

Hi
Struggled for 2-3 hours. Figured out the static folder needs to be placed out on the parent app folder rather than the appserver folder. Works fine with correct resolution PNG files.

Thanks,
L

[barrydow]

Just to add more info here... I'm getting a "500 Internal Server Error" when I try to bring up the icons directly using the paths shown previously.

[barrydow]

Howdy everyone -

I'm having this exact same issue with a Splunk 7.1.2 installation.

I've tried the troubleshooting steps suggested below, including resetting the owner and group on the files, and resetting the permissions for the apps. I'm unable to bring up the app icons directly using the paths that were shown in the discussion from back in 2015.

I seem to be seeing an error finding the path, or in permissions to get to the icons.

Is there a log file I should be able to find some more data in as to the failure to send my browser the icons?

[barrydow]

Oh, one more comment here - for my system, we use nginx on the system and must pass through it for authentication to the site. If that factors in, happy to look in appropriate paths for troubleshooting there too.

[Lucas_K]

I ran into this same missing icon today and found that can be part of a capability that has been split out.

To see those icons users roles must have "rest_properties_get" somewhere.

[BValchev]

That resolved the issue for me also

[cenduit_jgolden]

Thanks Lucas. Granting the user role "rest_properties_get" capability resolved this issue for me.

[alacercogitatus]

In your favorite Browser, open this tab:

http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png
or
http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt_2x.png

Do you see an icon in the browser? If you do NOT, then check file permissions on the searchheads. The images must be readable by Splunk.

If you do see the icon in the browser, there is something more sinister afoot. Don't forget to check the Network calls in the Developer Tools of the Browser, you might be able to see where it is breaking.

[alacercogitatus]

It's possible. Can you ls -la the folder $SPLUNK_HOME/etc/apps/search/static and $SPLUNK_HOME/etc/apps/search/appserver/static? post the results?

Copy the images from the search head to your local system, and see if they render correctly.

[mmensch]

/opt/splunk/etc/apps/search/static # ls -la
total 24
drwxr-xr-x  2 splunk splunk 4096 Sep  1 16:35 .
drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 ..
-r--r--r--  1 root   root    437 Sep  1 16:35 appIcon.png
-r--r--r--  1 root   root    444 Sep  1 16:35 appIconAlt.png
-r--r--r--  1 root   root    735 Sep  1 16:35 appIconAlt_2x.png
-r--r--r--  1 root   root    734 Sep  1 16:35 appIcon_2x.png

They also will not open in my windows machine.

[alacercogitatus]

Right, ok. So let's start with permissions. chown -R splunk: /opt/splunk/etc/apps. This will reset owner and group to splunk.

Once changed:

https://<your_splunk>/en-US/_bump

and

https://<your_splunk>/en-US/debug/refresh

This will reload the images and break any caches.

I'm also on IRC #splunk on Efnet.org if you wanna chat in realtime.

[alacercogitatus]

Oh, and do a chmod -R 755 /opt/splunk/etc/apps just to make sure.

[mmensch]

I am still having the same issue after issuing these commands.

I have bumped the version.

 https://<your_splunk>/en-US/debug/refresh

Does not load.

[barrydow]

Adding to the conversation down here to see if I can keep it straight better... same issue here, and did confirm that rest_properties_get is granted...

Permissions look like this:

cd /opt/splunk/etc/apps/search/static

ls -la

total 24
drwxr-xr-x. 2 splunk splunk 4096 Aug 13 16:05 .
drwxr-xr-x. 10 splunk splunk 4096 Jul 10 00:28 ..
-rwxr-xr-x. 1 splunk splunk 3556 Jul 9 23:26 appIcon_2x.png
-rwxr-xr-x. 1 splunk splunk 2547 Jul 9 23:26 appIconAlt_2x.png
-rwxr-xr-x. 1 splunk splunk 1981 Jul 9 23:26 appIconAlt.png
-rwxr-xr-x. 1 splunk splunk 3167 Jul 9 23:26 appIcon.png

[mmensch]

/opt/splunk/etc/apps/search/static # ls -la
total 24
drwxr-xr-x 2 splunk splunk 4096 Sep 1 16:35 .
drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 ..
-r--r--r-- 1 root root 437 Sep 1 16:35 appIcon.png
-r--r--r-- 1 root root 444 Sep 1 16:35 appIconAlt.png
-r--r--r-- 1 root root 735 Sep 1 16:35 appIconAlt_2x.png
-r--r--r-- 1 root root 734 Sep 1 16:35 appIcon_2x.png

I also have moved the icons over to my local windows machine and windows photo viewer is not able to view them.

[mmensch]

Thanks for the quick reply.

I went to the links you provided and I received the following:

"The image "https:///en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png" cannot be displayed because it contains errors.

Do you think this is a permission issue?