Security

Why are there missing and/or non-working navigation menus in Splunk Web using Firefox or Chrome with Splunk 6.3?

skovalenko
Explorer

I installed Splunk 6.3.0 build aa7d4b1ccb80. If I log in using either Firefox or chrome, none of the drop-down menus work (App, Messages, System, Activity, help). However, if I use Safari, everything works fine. Also, I have noticed that in Firefox I get only " Messages, System, Activity, Help" but in Safari I get "Administrator, Messages, Settings, Activity, Help and find"

Any suggestions on what could be the issue(s)?

1 Solution

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

View solution in original post

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

skovalenko
Explorer

Yes, I saw 404s for images and some other URLs in developer console. I cleared all cookies in Chrome and Firefox and it resolved the issue.

Thank you for your response

Stas

0 Karma

emiller42
Motivator

Glad to help! Keep in mind that this may come back if the offending cookie is recreated.

Also, if this worked, can you mark the answer as accepted so others can find it should they run into the same thing?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Are you using any browser extensions or plugins?

0 Karma

skovalenko
Explorer

I use firebug and adblock in firefox. But, even if I disable them, I get the same result. I installed 6.2.6 version on the same server and I have no issues with any browsers, but 6.3.0 only works in Safari.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...