Security

Why are there missing and/or non-working navigation menus in Splunk Web using Firefox or Chrome with Splunk 6.3?

skovalenko
Explorer

I installed Splunk 6.3.0 build aa7d4b1ccb80. If I log in using either Firefox or chrome, none of the drop-down menus work (App, Messages, System, Activity, help). However, if I use Safari, everything works fine. Also, I have noticed that in Firefox I get only " Messages, System, Activity, Help" but in Safari I get "Administrator, Messages, Settings, Activity, Help and find"

Any suggestions on what could be the issue(s)?

1 Solution

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

View solution in original post

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

skovalenko
Explorer

Yes, I saw 404s for images and some other URLs in developer console. I cleared all cookies in Chrome and Firefox and it resolved the issue.

Thank you for your response

Stas

0 Karma

emiller42
Motivator

Glad to help! Keep in mind that this may come back if the offending cookie is recreated.

Also, if this worked, can you mark the answer as accepted so others can find it should they run into the same thing?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Are you using any browser extensions or plugins?

0 Karma

skovalenko
Explorer

I use firebug and adblock in firefox. But, even if I disable them, I get the same result. I installed 6.2.6 version on the same server and I have no issues with any browsers, but 6.3.0 only works in Safari.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...