Can not extract fields in Splunk 6 with IE8

[andrewkenth]

I can't seem to extract fields in IE8. When I mouse over the generate or extract buttons the upper or lower part of the page goes blank. I unfortunatly can not adjust my security settings w/o a terrible week long administrative process. Is this causing it or could it be something else?

[somesoni2]

I had similar issues with IE8 and SPlunk 6. Upgraded to Splunk 6.0.1 and no issues with IE8.

[colecrew]

It is an ie8 and Splunk problem for sure, works fine with Firefox.

[jdastmalchi_spl]

try this

1- go to internet Explorer's menue and chose F12 Developertools
2- on the pop up the apears make sure the document mode is set to IE8 and not IE7.
3- let the page reload then go back to the field extraction page and now mouse over the button should not break anything.

[colecrew]

None of that worked

[andrewkenth]

Hi jtrucks,

My solution was to install IE10. Splunk runs much better in that browser and I can now use all the functionality. I was in a similar situation as you, I am almost certain my security settings were stopping the usage of some functions. For me the easiest solution was to install IE10, it was already approved and thus only required a quick helpdesk ticket in my organization.

[jtrucks]

I just tested the following with IE8 on Windows 7 accessing a Splunk 6 web UI:

1. Perform search
2. Click arrow at left of an event to open expanded dropdown box
3. Click on Event Actions button to get dropdown menu
4. Click Extract Fields
5. (new window opens)
6. Enter examples in "Example values for a field:" text box.
7. Click Generate
8. (examine results and screen writes, which all appear normal and fully functional)

This all worked perfectly fine. I would conclude that you have a client system/browser issue, not a Splunk 6 and IE8 issue.

[jtrucks]

and more…
Active scripting: Enable
Allow programmatic clipboard access: Enable
Enable XSS filter: Enable
Scripting of Java applets: Enable
User Auth: Logon: Auto logon only in Intranet zone

I have only used this instance for testing via citrix, so this is everything set on the browser.

[jtrucks]

Other settings…
Allow websites to use restricted protocols for Active Content: Prompt
Display mixed content: Prompt
Drag and drop or copy and paste files: Enable
Installation of desktop items: Prompt
Launching applications and unsafe files: Prompt
Launching programs and files in an IFRAME: Prompt
Navigate windows and frames across different domains: Enable
Open files based on content, not file extension: Enable
Submit non-encrypted form data: Prompt
Use Pop-up Blocker: Enable
Userdata persistence: Enable
Websites in less privileged web content zone can navigate into this zone: Enable

[jtrucks]

It looks like: Internet zone, Protected Mode enabled, some custom settings. All non-disabled settings are:
.NET Framework-reliant components: High Safety
Run components not signed with Authenticode: Enable
Run components signed with Authenticode: Enable
Binary and script behaviors: Enable
Download signed ActiveX controls: Prompt
Only Allow approved domains to use ActiveX without prompt: Enable
Run ActiveX controls and plug-ins: Enable
Script ActiveX controls marked safe for scripting: Enable
File download: Enable
Font download: Enable
Allow meta refresh: enable

[andrewkenth]

jtrucks,

What are you security settings for you host in your IE8?

Thanks!