Splunk Enterprise

Login delay+update notification on searchheads (at least) after restart

fuebel
Explorer

Hi there,

I'm very new to the Splunk infrastructure. We are running 8.0.3 Enterprise and I have a thing that I do not understand. When I restart our searchheads, the first login "stalls" after entering the username/password before the GUI loads. Might also happen again later, not sure. Also, I get the "a new version is available" message after each restart, even though I tried all answers I found to disable the update checking. But I still suspect it to be the culprit.

The delay happens while waiting for data from "/en-GB/app/launcher". The searchheads try to contact 35.164.43.215:443 and 34.218.138.15:443. Our Splunk environment does not have direct internet access, so those time out (but yet, it somehow found that a new maintenance version is available?).

I have set updateCheckerBaseURL to "0" as advised by other answers (btool outputs from a searchhead):

splunk btool web list settings --debug | grep updateCheckerBaseURL
/srv/splunk/etc/apps/oediv_all_search_base/local/web.conf updateCheckerBaseURL = 0

Internet-Access is supposed to be disabled completely, I think?:

splunk btool server list applicationsManagement --debug
/srv/splunk/etc/apps/oediv_cluster_search_base/local/server.conf [applicationsManagement]
/srv/splunk/etc/apps/oediv_cluster_search_base/local/server.conf allowInternetAccess = false

 

What else can I do to stop it trying to access the internet? The delay is annoying but not really a desaster, I just want to understand what's happening there.

Thanks in advance, Frank

Labels (2)
1 Solution

fuebel
Explorer

The other thing was that telemetry wasn't disabled. 

I changed these settings in apps/splunk_instrumentation/local/telemetry.conf and now I don't have a login delay any more.

sendAnonymizedUsage = false
sendAnonymizedWebAnalytics = false
sendLicenseUsage = True
sendSupportUsage = false

View solution in original post

fuebel
Explorer

The other thing was that telemetry wasn't disabled. 

I changed these settings in apps/splunk_instrumentation/local/telemetry.conf and now I don't have a login delay any more.

sendAnonymizedUsage = false
sendAnonymizedWebAnalytics = false
sendLicenseUsage = True
sendSupportUsage = false

fuebel
Explorer

At least the "update notification" part seems to be fixed now. We had the "updateCheckerBaseURL" in an app because that works for all the other web.conf settings, but when we moved it into etc/system/local/web.conf, the update notifications stopped showing up.

Still working on the login-delay.

0 Karma

mne
Engager

I have the same problem

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...