Has anyone experienced continuous automatic refreshing of Splunk (web console) dashboard or apps including searching.
When I visit Splunk console and try to navigate to any app or dashboard or even management console. It keeps refreshing every 2/3 seconds. I started noticing this behavior suddenly. I tried following
Splunk deployment
Seems like a Splunk bug with SSO when the dashboard has panels configured for auto-refresh.
Just clear your browser cached cookies and all Splunk tabs will stop auto-refreshing
SPL-177705
specifically, you might be seeing lines like so:
10-29-2019 11:07:25.865 -0700 ERROR UiAuth - Request from 10.209.0.34 to "/en-US/splunkd/__raw/servicesNS/someperson/someapp/search/jobs" failed CSRF validation -- expected "6641867248537937813", but instead cookie had "6641867248537937813" and header had "10543209232131847267"
from what I see, fixed in 7.2.10 and definitely fixed in 7.3 according to bug tracking
Try increasing connection timeout between the browser and Splunk web as below in web.conf and restart the Splunk instance:
Default:
server.socket_timeout = <integer>
* The timeout, in seconds, for accepted connections between the browser and Splunk Web
* Default: 10
Proposed:
server.socket_timeout = 60
This happens for us with Splunk when the SSO tokens expire as stated above. We need to refresh our tokens and get new windows. They refresh is maddening, especially since you could start to modify a search and then a refresh happens and you lose what you just typed.
If not just 'a dashboard' but 'all the screens of Splunk' are refreshing frequently, the first possibility is because of the SAML / SSO authentication. Please connect with your SAML provider team to check if your SSO is trying to refresh tokens frequently in your browser.
If it's only on the dashboard and not anywhere in Splunk, it is happening because of the refresh interval in the dashboard XML.
My dashboards continue to refresh every second and I tried every browser and it didn't work. Has anyone else come across this issue? Your help will be gladly appreciated.
Can you please check the source code of your dashboads and see whether you have something like <dashboard refresh="X">
or <form refresh="30">
?
Splunk user interface keeps refreshing. Is anyone else having the same problem? If so, can you please provide assistance to have this matter resolved. Your help and feedback is greatly appreciated.
Thanks,
Omar
What exactly is refreshing? maybe a screen-shot...
My dashboards.
The entire tab is refreshing. It'd have to be a movie to show the refresh. 🙂
I see @brenthale ; - ) I had a similar case at Does a dashboard keep refreshing itself by default?
Does it make sense?
Often it is not a Dashboard but a simple Search page with a query that is refreshing. I've seen it refresh in both instances.
What sort of authentication are you using? Seeing this with SSO/SAML and my suspicion is it might be a page element attempting to establish a new session (I could be wrong).
hey @shrikant0013,
Check out this post, and see if there is any information in there that answers your question.
Thanks for posting!
I did some google searching and had come across this post. That post talks about custom dashboard. I notice this behavior on default Splunk dashboards/pages as well
Hi @shrikant0013,
this might not be a problem of splunk, but the problem of your webbrowser.
What you describe is actually a problem that already happened with browsers before.
Just google "How do I stop name of your browser from refreshing pages constantly? "
I get this problem as well. It only seems to happen with Splunk dashboards or Searches; other web-pages are not getting refreshed. It seems to be limited to Splunk pages.
This is annoying when it gets into this mode. Sometimes I can simply copy the URI, close the tab, open a new tab and paste in the URI and it is ok. But I'd rather not do that.
Here is an update to what I am seeing.
I just got into the refresh behavior again. This time I made it go away by closing down a lot of tabs in my browser window. I had ~20+ tabs open in each of 3 separate Chrome windows (don't judge me). Once I closed a bunch of tabs the refresh problem stopped happening.
Yes, I have too many tabs open. But refreshing Splunk windows doesn't seem like it should be happening either.
Thanks for the comment. I do not experience this behavior for other sites Also my team mates has same experience on his laptop and browser.
I have another Splunk Instance (similar config but used for staging/test with few events). This one seems fine.
Also if it helps, auto refreshing is aggressive initially when page is loading to calms down as the page gets loaded in few minutes.