Security

Why are there missing and/or non-working navigation menus in Splunk Web using Firefox or Chrome with Splunk 6.3?

skovalenko
Explorer

I installed Splunk 6.3.0 build aa7d4b1ccb80. If I log in using either Firefox or chrome, none of the drop-down menus work (App, Messages, System, Activity, help). However, if I use Safari, everything works fine. Also, I have noticed that in Firefox I get only " Messages, System, Activity, Help" but in Safari I get "Administrator, Messages, Settings, Activity, Help and find"

Any suggestions on what could be the issue(s)?

1 Solution

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

View solution in original post

emiller42
Motivator

Check what cookies are applying when you hit your splunk instance. Specifically, any cookies that contain JSON or square brackets. If you drop those, and reload splunk, I bet it clears up your issue.

We ran into the same thing. Splunk is set up as a subdomain along with other internal tools. So https://splunk.ourdomain.com. A cookie was getting set scoped to *.ourdomain.com that included JSON payload, and it caused issues with Splunk web properly understanding user context. If you open your browsers developer console, I bet you see a lot of underlying 404's with 'undefined' in the url where your username should be.

The reason why it only happens in some browsers and not others is that the offending cookie probably doesn't exist on the working browser.

skovalenko
Explorer

Yes, I saw 404s for images and some other URLs in developer console. I cleared all cookies in Chrome and Firefox and it resolved the issue.

Thank you for your response

Stas

0 Karma

emiller42
Motivator

Glad to help! Keep in mind that this may come back if the offending cookie is recreated.

Also, if this worked, can you mark the answer as accepted so others can find it should they run into the same thing?

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Are you using any browser extensions or plugins?

0 Karma

skovalenko
Explorer

I use firebug and adblock in firefox. But, even if I disable them, I get the same result. I installed 6.2.6 version on the same server and I have no issues with any browsers, but 6.3.0 only works in Safari.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...