Splunk Supported Browsers - Should Firefox status be updated ?

[guilmxm]

Hi,

Splunk Browsers requirements mentions that Splunk supports Firefox starting with v24.2 ESR:

http://docs.splunk.com/Documentation/Splunk/6.2.2/Installation/Systemrequirements

Supported browsers Splunk Enterprise
supports the following browsers:

Firefox ESR (24.2) and latest Internet
Explorer 9, 10, and 11 Safari (latest)
Chrome (latest)

That seems to be partially right with Firefox and latest Splunk features, upon numerous tests we've done (with almost every Firefox versions starting 24.2 ESR to latest), we could determine that features like:

• Populating form inputs (dropdown, multiselect...) in Simple xml using PostProcess searches (a main inline search referenced by id, forms using base PostProcess searches) won't work in Firefox prior to 37.0.1

Using search syntax "" (non deprecated, embedded with last recent Splunk versions):

http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#Search_element

And using form dashboards.

Firefox prior to 37.0.1 is unable to populate form using inline search based over a min search, the same dashboard works perfectly with MSIE or Chrome, and Firefox starting 37.0.1

• Hiding elements in Simple xml ("depends" or "reject" using tokens to be set in panels, inputs, searches and so on) won't either work with Firefox prior to 37.0.1, the URL stays followed by the token and value, but nothing happens.

Same thing works perfectly fine with any other browser such as MSIE (starting v9), or Chrome.
Thus this works perfectly fine with Firefox starting 37.0.1

Shouldn't the documentation be updated to remove 24.2 ESR at least with Splunk 6.2.2 ?

The Firefox version 37.0.1 is quite recent and we have been very surprised to see that the full compatibility with Splunk recent features (such as populating searches using post process non deprecated search syntax) starts with only very recent Firefox versions.
While this works fine with much older browsers like MSIE 9...

To summarize, only the latest Firefox version is really compatible with Splunk 6.2.2, at least.

Other browsers like Chrome or Safari mentions "latest" as supported version, Firefox mentions 24.2 ESR and latest, this does not seem to be true anymore...

Tests were done on different Windows workstations (WinXP & 7), over Splunk 6.2.2 running in Linux server environment (sh cluster)

Guilhem

[malmoore]

Hi @guilmxm, apologies for not responding sooner, I've been out of the office on vacation.

This seems like a bug. I will follow up with folks here and either open a ticket to have the issue sorted out or provide a response as to why Firefox isn't supported in this way. Thank you in advance for your patience.

[guilmxm]

Hello maloore, hope you are fine.

Do you have any new information about this issue ?

I have been trying to debug this as much as possible, i can confirm something: This is 100% related with the time range picker form:

• As long your base search has a time range defined by a time form module, the view randomly works, and randomly fails, the URL does not get completed and the view gets blocked. (showing waiting fir input)

• If the search base does not uses the time token (global or user defined) by a static earliest and latest, then the view always works, the URL gets completed but sometimes it seems to a few more time to be completed.
  Thus, forms immediately starts to be populated (even if the URL is not yet completed) and then the view is fully loaded

The problem affects any version of Firefox...

Thank you !

[guilmxm]

Hello,

I just did a test under last Firefox Version "39.0", and unfortunately while it was working fine with a previous Firefox version, using a base search and post process searches (see above) to populate forms DOES NOT work.

Form keeps being waiting for input:

The same view just works perfectly with MSIE or Google Chrome, this is a very annoying issue.

Guilhem

[guilmxm]

Hi @malmoore,

Unlike you answered, 31.2 ESR is not fully supported as you cannot use post processes searches to populate forms in simple xml. (which is a great improvement when you're building efficient interfaces).

Only 37.x and more will support simple xml views using such technique, to illustrate:

• Took the example from the simple xml reference: http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#Search_element
• Added a time input form and 2 multiselect forms using the same search, added token to filter based on user selection

Here is the simple xml code:

<form>
  <label>Dashboard with post-process search</label>
  <description></description>
  <!-- Base search cannot pass more than 10,000 events to post-process searches-->
  <!-- Example uses stats transforming command -->
  <!-- This limits events passed to post-process search -->
  <search id="baseSearch">
    <query>index=_internal source=*splunkd.log | stats count by component, log_level</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>  </search>
  <row>
    <panel>
      <input type="time" token="time" searchWhenChanged="true">
        <label>Time:</label>
        <default>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </default>
      </input>
      <input type="multiselect" token="component" searchWhenChanged="true">
        <label>Component:</label>
        <search base="baseSearch">
          <query>fields component | sort component | dedup component</query>
        </search>
        <fieldForLabel>component</fieldForLabel>
        <fieldForValue>component</fieldForValue>
        <valuePrefix>component="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
        <choice value="*">ANY</choice>
        <default>*</default>
      </input>
      <input type="multiselect" token="log_level">
        <search base="baseSearch">
          <query>search $component$ | stats count by log_level | sort log_level</query>
        </search>
        <fieldForLabel>log_level</fieldForLabel>
        <fieldForValue>log_level</fieldForValue>
        <valuePrefix>log_level="</valuePrefix>
        <valueSuffix>"</valueSuffix>
        <delimiter> OR </delimiter>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Event count by log level</title>
        <!-- post-process search -->
        <search base="baseSearch">
          <query>search $component$ $log_level$ | stats sum(count) AS count by log_level</query>
        </search>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Error count by component</title>
        <!-- post-process search -->
        <search base="baseSearch">
          <query>search $component$ $log_level$ | stats sum(count) AS count by component</query>
        </search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</form>

• The view will perfectly work with Chrome, and even MSIE (starting 8 or 9)

  • The view will never work with Firefox prior to 37.0.1, input forms keep being waiting for input
  • The view will perfectly work with any Firefox version starting 37.0.1

So we cannot really say that the Firefox version you updated in the doc is fully supported, but now the last ESR will. (at the time i am writing 38.1.0)

I haven't tested every version and sub-version, but i can confirm that i never had success with any version prior to 37.0.1.

Guilhem

[malmoore]

Hi,

We do, as a matter of course, support the latest version of Firefox ESR.

The version number that we list in this page is incorrect. At the time of GA of Splunk 6.2.2, the current ESR version was 31, not 24. The minor version was 31.4esr, which was released on January 13, 2015. Splunk Enterprise 6.2 was released on October 28, 2014, and 6.2.2 was released on February 23, 2015.

So I have updated this page to note the correct ESR version for Splunk 6.2.

I still have some research to complete re: exact versions for ESR and will update this topic with additional information as needed.

[saikatr]

IE-9 is also incompatible with Splunk 6.2.2. We keep on getting an error message saying "server error", when we run searches/open reports etc. Sometimes when you click on an item, it simply disconnects and opens only after refreshing the page 5-6 times.

Splunk support said the very same thing when we raised it as a case with them.

IE-9 should definitely be removed as a compatible browser.

[guilmxm]

@malmoore: Thank you for your quick reply, and for the Documentation update.

I have also some little things to double check, specially the compatibility of Populating forms using Post processed searches in Simple xml form dashboards, will re-check but as far as i remember the last Firefox ESR could not successfully run such views.
Will update the topic.

[rjthibod]

It looks like I have run into this exact issue with post-process results on FF 31.7.0 ESR on 6.2.X. It consistently fails to load my dashboard unless I remove the input forms that rely on a base search.

[guilmxm]

Hi, that was one of the purpose of this post.

AS you noticed, and unlike it has been answered, Mozilla Firefox won't play well with input forms using subprocess to be populated, unless you have a very recent Firefox version (at least 37.0.1)

I will update the post with a concrete example.

Guilhem

[ChrisG]

Thanks for raising this question, the doc team is looking into it!