This comment might not apply to the specific circumstances of this question, but I think it's worth mentioning here for users searching for answers:
are you running [Splunk in] multiple [Docker] containers on the same host? If so, the session-key cookie will break as it's tracked by the url of the host.
That is, if you access multiple instances of Splunk Web on the same server—for example, http://mydockerhost:8801 and http://mydockerhost:8802 —from tabs of the same browser, then you'll experience the error reported in this question.
For details, see docker-splunk GitHub issue #68.
... View more