Splunk Dev

Splunk Bookmarks not working in Firefox and Chrome

eroffol
Path Finder

Overview
Our users use several dashboards we have in our app. They would like to have the ability to select filters on the dashboard, bookmark them, and navigate back to them later without having to reenter any filter values. Most of the filters on our dashboards are multiselect fields with a default value of: name="All" value=".*"

Currently, we can set filters and bookmark a page. Unfortunately, when navigating to that bookmark in a fresh browser session, we have 2 main problems:
1. Our custom css and js does not get applied to the dashboard
2. Out multiselects are not populated correctly with the default values

Reproducing:
1. Navigate to a dashboard with multiselect fields. Select a value where name="All" and value=".*"
2. Bookmark that page
3. Close firefox
4. Open a new private browsing session
5. Navigate to the saved bookmark
At this point, the multiselect field will be populated with ".%2A" instead of "All". Also, none of the custom js/css will be applied. If I open up the debug console, it looks like the domain is wrong for the URL of the JS/CSS (with a 307 error). It uses "splunk" as the domain instead of what it should use.
Example:
Bookmark loads this: https://splunk/en-US/static/@03bbabcabf43/app/testApp/dashboard.css
Instead of this: https://local.test/en-US/static/@03bbabcabf43/app/testApp/dashboard.css

If I refresh the page, all of the JS/CSS loads properly, but the multiselect fields are still incorrect.
If I click the bookmark again, everything looks just fine. JS/CSS loads correctly and the multiselects populate with "All"
If I use bookmarks in IE, it works fine. JS/CSS loads properly and multiselects populate with "All"

Environment information:
Splunk version: 7.1.2
Browser: Firefox (various versions), Chrome (various versions)
Relevant architecture info: Splunk search head cluster (3 members) behind a load balancer

Is there something I have to do to get bookmarks to work? Our users are not motivated enough to click a bookmark twice to get it to load correctly

0 Karma

eroffol
Path Finder

I figured out a work around for the .%2A problem.
In my search, I just added an eval statement to convert %2A to .* The below statement checks my multiselect for %2A, , or All and sets matcher to . if they match. If not, just use what is in the multiselect.

| eval matcher = if(match($multiselect1$, "\((\*|\.?%2A|All)\)"), ".*", $multiselect1$)
| where match(field, matcher)

I still have the 307 error problem with my js and css the first time I navigate to my bookmark in a fresh browsing session (like in private or incognito). Any suggestions would help!

0 Karma

eroffol
Path Finder

Another update:

This error only occurs if I save a bookmark with filters selected.
For example, if I save a bookmark like this, it works fine (JS/CSS applied correctly):

https://local.test/splunk/en-US/app/testApp/testDashboard

If I save a bookmark with filters selected, I get the 307 error where it can't find my JS/CSS because it is using the wrong domain

https://local.test/splunk/en-US/app/testApp/testDashboard?form.filter1="All"&form.filter2=".*";
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...