Splunk Web Pages and the SA box

[muttbarker_]

Question to the group - is anyone running the Splunk application through SSL? I have a new customer that I am bringing up and they just created a Web bookmark brings up the Splunk web based search engine. They are running into some display issues and asked if I could do a quick check to see if anyone out there is running this tool and had any input on how it functions.

Any feedback?

[rmullis_]

Did you ever figure this out? Would like to do the same thing.

[muttbarker_]

If I recall this one correctly it uses Adobe Flash 10 and the SSL box only supports 9. So no solution.

[ESpa_]

Recently Splunk got upgraded to be fully running on JavaScript. That should improve things.

However I still have issues even when using 7.1R5.

It looks like things are going wrong with the URL on the outside:

https://customersite.something.com/sub/sub/,DanaInfo=1.1.1.1+page.aspx

would internally mean something like:

http://1.1.1.1/sub/sub/page.aspx

The original page that seemingly has links that cannot be rewritten have links like:

/sub/sub/page.aspx

As Juniper adds the DanaInfo part, the above URL that has unrwritable links uses location that cannot be found via the Juniper SA.

How to get through to this one?

[zanyterp_]

The rewritten URL looks fine.

Which failure are you seeing?

Your best bet will be to work with JTAC to have it looked at and see what can be done.

For the case, please get the information here: http://www.juniper.net/techpubs/software/ive/guides/troubleshooting/RewriteTroubleshootingandLogColl...

[tsm_]

I am running in the same problem. Cause I do not want to use "Pass Through Proxy or JSAM" I hope that Juniper could provide a solution based on the java rewriting mechanism.

How does the current solution looks like?

thanks and regards,

Thilo

[jayLaiz_]

There is a bug we fixed in 7.r2 for the Splunk web application which is in the 7.2r2 release notes 35.web-javascript - IVE is not able to load the dashboard screen of Splunk web application. (754687) Also, a custom header to allow custom headers is required for the application URL,the same fix also would be in 7.1r10 which will be available publicly soon If the issue is not related to the dashboard page not loading completely,it is better to open a new JTAC case so that It can be investigated Regards, Jay

[zanyterp_]

from the little i have done with splunk, it does not look like it uses java; however, if it does, you would need to make sure you have a java acl configured.which issue are you seeing? which ive os?

[yuval_ba_]

I am facing this issue (after login to the Splunk page all inside screens are stuck on "Loading...").

Running 7.2R4

Could you please explain "a customer header is required for the application URL" ?

I am hoping to avoid opening a JTAC...

[zanyterp_]

Sorry; typo that I generally catch. :embarrassed: that was supposed to be _custom_ headers


The "custom header" is an option in the rewriter that allows extra "stuff" that some web servers use for handling traffic. These are enabled at Users>Resource Policies>Web>Rewriting>Custom Headers. Create a new policy & set the resource to *:* and the action to "allow custom headers".