Dashboards & Visualizations

How to fix broken Menu Icons in the app navigation drop-down menu?

mmensch
Path Finder

Hello,

In the app navigation menu, the area where you can switch between apps, all of the menu icons are broken. Instead of showing the small image, it shows a text box that says "menu icon." I have attached an image of this. Please note that this is for all apps as well, not just search & reporting.

The problem here is that multiple people work on the same Splunk Instance and new JavaScript & CSS are constantly being added. No one noticed when this first happened, so we cannot track it back to where it happened.

Does anyone have any insight on where this error might be at? How to fix this?

Thanks

alt text

0 Karma

sysjohn
Loves-to-Learn Everything

Hello,

regarding your comment "for my system, we use nginx on the system", I believe the issue is to do with sticky/persistent sessions within nginx that Splunk needs to run correctly. If you use "ip hash;" within your nginx.conf file this should resolve the issue.

The reason for this is that once you log in the session, the "login cookies" are not sent over with the session.

So instead of having:

"/en-US/splunkd/_raw/servicesNS/AUTHENTICATEDUSER/search/static/appIconAlt.png"

you will get something like:

"/en-US/splunkd/_raw/servicesNS/undefined/search/static/appIconAlt.png".

0 Karma

linu1988
Champion

Hi
Struggled for 2-3 hours. Figured out the static folder needs to be placed out on the parent app folder rather than the appserver folder. Works fine with correct resolution PNG files.

Thanks,
L

0 Karma

barrydow
New Member

Just to add more info here... I'm getting a "500 Internal Server Error" when I try to bring up the icons directly using the paths shown previously.

0 Karma

barrydow
New Member

Howdy everyone -

I'm having this exact same issue with a Splunk 7.1.2 installation.

I've tried the troubleshooting steps suggested below, including resetting the owner and group on the files, and resetting the permissions for the apps. I'm unable to bring up the app icons directly using the paths that were shown in the discussion from back in 2015.

I seem to be seeing an error finding the path, or in permissions to get to the icons.

Is there a log file I should be able to find some more data in as to the failure to send my browser the icons?

0 Karma

barrydow
New Member

Oh, one more comment here - for my system, we use nginx on the system and must pass through it for authentication to the site. If that factors in, happy to look in appropriate paths for troubleshooting there too.

0 Karma

Lucas_K
Motivator

I ran into this same missing icon today and found that can be part of a capability that has been split out.

To see those icons users roles must have "rest_properties_get" somewhere.

BValchev
Engager

That resolved the issue for me also

0 Karma

cenduit_jgolden
Explorer

Thanks Lucas. Granting the user role "rest_properties_get" capability resolved this issue for me.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

In your favorite Browser, open this tab:

http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png
or
http://<yourSplunk>/en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt_2x.png

Do you see an icon in the browser? If you do NOT, then check file permissions on the searchheads. The images must be readable by Splunk.

If you do see the icon in the browser, there is something more sinister afoot. Don't forget to check the Network calls in the Developer Tools of the Browser, you might be able to see where it is breaking.

alacercogitatus
SplunkTrust
SplunkTrust

It's possible. Can you ls -la the folder $SPLUNK_HOME/etc/apps/search/static and $SPLUNK_HOME/etc/apps/search/appserver/static? post the results?

Copy the images from the search head to your local system, and see if they render correctly.

0 Karma

mmensch
Path Finder
/opt/splunk/etc/apps/search/static # ls -la
total 24
drwxr-xr-x  2 splunk splunk 4096 Sep  1 16:35 .
drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 ..
-r--r--r--  1 root   root    437 Sep  1 16:35 appIcon.png
-r--r--r--  1 root   root    444 Sep  1 16:35 appIconAlt.png
-r--r--r--  1 root   root    735 Sep  1 16:35 appIconAlt_2x.png
-r--r--r--  1 root   root    734 Sep  1 16:35 appIcon_2x.png

They also will not open in my windows machine.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Right, ok. So let's start with permissions. chown -R splunk: /opt/splunk/etc/apps. This will reset owner and group to splunk.

Once changed:

https://<your_splunk>/en-US/_bump

and

https://<your_splunk>/en-US/debug/refresh

This will reload the images and break any caches.

I'm also on IRC #splunk on Efnet.org if you wanna chat in realtime.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Oh, and do a chmod -R 755 /opt/splunk/etc/apps just to make sure.

0 Karma

mmensch
Path Finder

I am still having the same issue after issuing these commands.

I have bumped the version.

 https://<your_splunk>/en-US/debug/refresh

Does not load.

0 Karma

barrydow
New Member

Adding to the conversation down here to see if I can keep it straight better... same issue here, and did confirm that rest_properties_get is granted...

Permissions look like this:

cd /opt/splunk/etc/apps/search/static

ls -la

total 24
drwxr-xr-x. 2 splunk splunk 4096 Aug 13 16:05 .
drwxr-xr-x. 10 splunk splunk 4096 Jul 10 00:28 ..
-rwxr-xr-x. 1 splunk splunk 3556 Jul 9 23:26 appIcon_2x.png
-rwxr-xr-x. 1 splunk splunk 2547 Jul 9 23:26 appIconAlt_2x.png
-rwxr-xr-x. 1 splunk splunk 1981 Jul 9 23:26 appIconAlt.png
-rwxr-xr-x. 1 splunk splunk 3167 Jul 9 23:26 appIcon.png

0 Karma

mmensch
Path Finder

/opt/splunk/etc/apps/search/static # ls -la
total 24
drwxr-xr-x 2 splunk splunk 4096 Sep 1 16:35 .
drwxr-xr-x 10 splunk splunk 4096 Jul 22 21:49 ..
-r--r--r-- 1 root root 437 Sep 1 16:35 appIcon.png
-r--r--r-- 1 root root 444 Sep 1 16:35 appIconAlt.png
-r--r--r-- 1 root root 735 Sep 1 16:35 appIconAlt_2x.png
-r--r--r-- 1 root root 734 Sep 1 16:35 appIcon_2x.png

I also have moved the icons over to my local windows machine and windows photo viewer is not able to view them.

0 Karma

mmensch
Path Finder

Thanks for the quick reply.

I went to the links you provided and I received the following:

"The image "https:///en-US/splunkd/__raw/servicesNS/admin/search/static/appIconAlt.png" cannot be displayed because it contains errors.

Do you think this is a permission issue?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...