Security

How to remove Splunk login page iframe?

dcascione
Explorer

Hello! I would like to understand what content should be displayed in the login page iframe and also how to remove it permanently (currently displaying an error). Any help would be greatly appreciated - Thanks!

iframe error

0 Karma
1 Solution

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

View solution in original post

chris24747
Explorer

Hi, no need for hacking js files, it's an option in web.conf:

updateCheckerBaseURL = http://quickdraw.Splunk.com/js/

  • Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself.

so :
[settings]
updateCheckerBaseURL=0

dcascione
Explorer

Thanks for the alternate answer. I reverted my changes and updated the [settings] option as you described above!

0 Karma

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

dcascione
Explorer

Yes! Navigating here: share/splunk/search_mrsparkle/exposed/js/login.js

I changed the url from "http://www.splunk.com/r/download" to just "" and it resolved the issue.

template: '\
                <a href="http://www.splunk.com/r/download" class="btn"><%= _("Download").t() %></a>\
                <a href="#" class="skip"><%= _("Skip update").t() %></a>\

Thanks!

lycollicott
Motivator

This isn't much to go on. What's your browser? What's in your web.conf? Specifically the login_content line?

0 Karma

dcascione
Explorer

Hello - For some reason the description I added along with the photo isn't showing - my apologies. Basically I want to know where the login page is located on the Splunk Enterprise Search Head and how to remove the iframe imbedded in the page. Right now its displaying the error finding the page to fill the iframe. We are currently using IE11. Thanks!

0 Karma

lycollicott
Motivator

I believe that is dynamically generated content by a combination of json, js and css.

Do you have a "login_content" line in either system/default/\web.conf or system/local/web.conf ?

That line specifies what is to be auto generated and your screen shot sort of looks like "login_content" might be set something invalid.

0 Karma

dcascione
Explorer

Found the line in systems/default/web.conf

Custom content for login screen

login_content =

Tried to comment out the reference and reboot the system with no change.

0 Karma

dcascione
Explorer

changed to login_content = false and now I see the word "false" above the blank iframe!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...