Security

How to remove Splunk login page iframe?

dcascione
Explorer

Hello! I would like to understand what content should be displayed in the login page iframe and also how to remove it permanently (currently displaying an error). Any help would be greatly appreciated - Thanks!

iframe error

0 Karma
1 Solution

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

View solution in original post

chris24747
Explorer

Hi, no need for hacking js files, it's an option in web.conf:

updateCheckerBaseURL = http://quickdraw.Splunk.com/js/

  • Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself.

so :
[settings]
updateCheckerBaseURL=0

dcascione
Explorer

Thanks for the alternate answer. I reverted my changes and updated the [settings] option as you described above!

0 Karma

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

dcascione
Explorer

Yes! Navigating here: share/splunk/search_mrsparkle/exposed/js/login.js

I changed the url from "http://www.splunk.com/r/download" to just "" and it resolved the issue.

template: '\
                <a href="http://www.splunk.com/r/download" class="btn"><%= _("Download").t() %></a>\
                <a href="#" class="skip"><%= _("Skip update").t() %></a>\

Thanks!

lycollicott
Motivator

This isn't much to go on. What's your browser? What's in your web.conf? Specifically the login_content line?

0 Karma

dcascione
Explorer

Hello - For some reason the description I added along with the photo isn't showing - my apologies. Basically I want to know where the login page is located on the Splunk Enterprise Search Head and how to remove the iframe imbedded in the page. Right now its displaying the error finding the page to fill the iframe. We are currently using IE11. Thanks!

0 Karma

lycollicott
Motivator

I believe that is dynamically generated content by a combination of json, js and css.

Do you have a "login_content" line in either system/default/\web.conf or system/local/web.conf ?

That line specifies what is to be auto generated and your screen shot sort of looks like "login_content" might be set something invalid.

0 Karma

dcascione
Explorer

Found the line in systems/default/web.conf

Custom content for login screen

login_content =

Tried to comment out the reference and reboot the system with no change.

0 Karma

dcascione
Explorer

changed to login_content = false and now I see the word "false" above the blank iframe!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...