Splunk Search

a blank tab created after clicking "open in search" in specific dashboard panel while SPL is ~10K long

mchang_splunk
Splunk Employee
Splunk Employee

We have a critical dashboard where users need to click on the magnifying glass to open up that search in a search window.
When they click on it it just launches a blank tab instead of the search window. Same happens for me and I'm an admin.

We have distributed deployment including SH, IDX on AWS instances.

The odd is when I deploy the same dashboard on standalone Splunk instance running on my laptop, I can see new search tab is created with correct SPL.

BTW, the total length of SPL is approximately 10K, I know it's a long SPL but wonder what might be the root cause?

Tags (1)
0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

since the URL is approximately ~10k, chrome or firefox can take 32k+ URL by referring to this thread:
https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers

So it's not browser issue as you can verify on local standalone Splunk instance.

Splunk follows http1 with limitation of 16K.
The root cause could be the har limits of load balancers on AWS.

Here is the AWS document mentioned about the URL length limitation for http2 is at 8K:
https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.h...

HTTP Header Limits
The following size limits for Application Load Balancers are hard limits that cannot be changed.

    HTTP/1.x Headers
    Request line: 16 K
    ....
    HTTP/2 Headers
    Request line: 8 K
    ....

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

since the URL is approximately ~10k, chrome or firefox can take 32k+ URL by referring to this thread:
https://stackoverflow.com/questions/417142/what-is-the-maximum-length-of-a-url-in-different-browsers

So it's not browser issue as you can verify on local standalone Splunk instance.

Splunk follows http1 with limitation of 16K.
The root cause could be the har limits of load balancers on AWS.

Here is the AWS document mentioned about the URL length limitation for http2 is at 8K:
https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/how-elastic-load-balancing-works.h...

HTTP Header Limits
The following size limits for Application Load Balancers are hard limits that cannot be changed.

    HTTP/1.x Headers
    Request line: 16 K
    ....
    HTTP/2 Headers
    Request line: 8 K
    ....
0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...