Getting Data In

SplunkJS Stack not working as expected?

f_luciani
Path Finder

I have 2 servers:

Server1 (Debian) - prod server

  • Splunk Enterprise 6.1.2
  • Apache 2.2.16 (hosting a website, not related to Splunk)

Server2 (Ubuntu) - dev server

  • Splunk Universal Forwarder 6.1.3
  • Apache 2.2.22 (not in use, for testing purposes)

Both servers have a public IP address and a FQDN. They are not located in the company's premises, they are being kept in a datacenter, so I can run tests with real results.
I've been asked by a client whether an Splunk dashboard can be viewed outside Splunk Web, i.e., an html document served by Apache that retrieves the dashboard from another server. I found out about SplunkJS Stack and started running tests to see if I could fulfil the client's request. I've started here:

http://dev.splunk.com/view/web-framework/SP-CAAAER6

I am no dev, so I got a bit lost about the SDK. Besides, the client only wants to write an html doc, put it in Apache's root directory and access it from anywhere in the web without typing/passing Splunk's URL to other people. So I opted for SplunkJS Stack, seemed easier. I read these:

http://dev.splunk.com/view/SP-CAAAEWR

http://dev.splunk.com/view/SP-CAAAEW6

http://dev.splunk.com/view/SP-CAAAEWS

http://dev.splunk.com/view/SP-CAAAEV9

I thought about using Server2 to host the html docs with js code from the examples found in the above-mentioned docs (adapted) in order to request a previously saved html dashboard from Server1. Reading the docs, I decided to go with CORS since it required minimum changes in both servers (assuming some clients won't allow much changes - hope for the best, prepare etc.). Then the questions started piling up.

  • First of all, can I have, for instance, an html login page (just an example) in Server2 in order to try to login into Server1, or the html (web pages) should be hosted in the same server I have Splunk Enterprise? (In this case, CORS or proxy or whatever is a bit pointless, just checking to see if I got it right)
  • Regarding the place where I should store the JS Stack files (I've downloaded ver. 1.1), I have Apache pointing to /var/www, as it is usual for vanilla installs, so I assumed I should ftp splunkjs and splunkjs.min folders inside it, and all mentions to these directories in the js part of the html docs (css, libraries, etc.) should be corrected accordingly. The code would change, for instance, from href="static/splunkjs/css/bootstrap.css" to href="splunkjs/css/bootstrap.css". Was that assumption correct?
  • Other variables in the "Authenticate users..." page example I've been trying to make work for me (login_form.html) are not so guessable: baseUrl: "static/" (should I change it to "/" or "./"?); host: "localhost" (should localhost be replaced by server1.x.com, server2.x.com or should I leave it like that?); var http = new jssdk.ProxyHttp("/proxy") (should it be "/"? I am not using any proxy but if I try to get rid of the lines that follow it, the login function just after it throws an error - "service not defined").
  • I have both Apache installations configured to accept each other's request (just in case);
  • Splunk in both servers is set for CORS in server.conf;
  • if I user curl from the prompt I get a session key from both servers targeting each other and/or themselves;
  • I can login into both admin interfaces through port 8089 via Firefox 31.0 and user admin/mypasswordhere;

...but if I try any of the test_xxx.html pages provided with the JSStack zip, even though I've been changing them in every possible way, the farthest I get is seeing in Firefox console the message "Login failed: No session key available".

I had all kinds of messages before, so I guess the corrections and assumptions worked for some things. I've already restarted the servers several times, closed browsers, cleaned chaches, changed browsers, to no avail. What am I missing here? Any help at this point would be greatly appreciated, for I've spent the best part of this week stuck with this problem.

1 Solution

f_luciani
Path Finder

Found the answer inside the README.MD file that comes with the JS zip file. The first step before anything should be changing the parameters in config.js to meet your needs, according to this link: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_splunkjsconfig.html. The comments inside README.MD also help understanding what is to be changed and what's not.

View solution in original post

0 Karma

f_luciani
Path Finder

Found the answer inside the README.MD file that comes with the JS zip file. The first step before anything should be changing the parameters in config.js to meet your needs, according to this link: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_splunkjsconfig.html. The comments inside README.MD also help understanding what is to be changed and what's not.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...