a blank tab created after clicking "open in search" in specific dashboard panel while SPL is ~10K long

[mchang_splunk]

We have a critical dashboard where users need to click on the magnifying glass to open up that search in a search window.
When they click on it it just launches a blank tab instead of the search window. Same happens for me and I'm an admin.

We have distributed deployment including SH, IDX on AWS instances.

The odd is when I deploy the same dashboard on standalone Splunk instance running on my laptop, I can see new search tab is created with correct SPL.

BTW, the total length of SPL is approximately 10K, I know it's a long SPL but wonder what might be the root cause?

[mchang_splunk · Accepted solution]

since the URL is approximately ~10k, chrome or firefox can take 32k+ URL by referring to this thread:
https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers

So it's not browser issue as you can verify on local standalone Splunk instance.

Splunk follows http1 with limitation of 16K.
The root cause could be the har limits of load balancers on AWS.

Here is the AWS document mentioned about the URL length limitation for http2 is at 8K:
https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.h...

HTTP Header Limits
The following size limits for Application Load Balancers are hard limits that cannot be changed.

    HTTP/1.x Headers
    Request line: 16 K
    ....
    HTTP/2 Headers
    Request line: 8 K
    ....