Internet Explorer Login Fails

[kmattern]

This is a new one! I cannot log into Splunk using Internet Explorer. I could earlier today and I use IE 99% of the time. I also tried Google Chrome and had the same result. The fields are cleared, no message or anything else. I have totally rebooted my box to no avail. I also stopped and restarted Splunk. That didn't help either.

It works fine in FireFox.

Others in my organization are having the same problem and it began just today.

Version 4.0.11 Linux

What gives?

[kmattern · Accepted solution]

I was required to set my forwarder to perpetually remain on a specific date. The computer I'm using to access Splunk had the current date. As soon as I changed the current date to be the same as the Splunk computer I was able to get in.

[rotten]

What authentication method are you using? Did your LDAP server go down? (Splunk doesn't automatically failover, you have to connect as the admin user and flip it if you have a preconfigured backup.)

We actually use an F5 between Splunk and our LDAP server, and we have a backup configuration preconfigured as well.

If you can't get into the Splunk UI at all, check out $SPLUNK_HOME/etc/system/local/authentication.conf to see how you are authenticating. You may need to temporarily move it out of the way, and bounce splunk, to revert to the default authentication method (local file).

If you are using a local file based authentication, is it possible you trashed it somehow? I believe you can hack $SPLUNK_HOME/etc/passwd to try to recover from such a disaster. Search around for "I forgot my admin password" for hints on how to recover it.

[rotten]

Did you get a Flash upgrade? Are both IE and FF using the same version of Flash?

[kmattern]

Rotten,

I think you missed this sentence in my question:

"It works fine in FireFox."

Yes, I am using LDAP but cannot get in using the failsafe user id. But all user ids work fine in FireFox.

Something strange is going on.

Ken