Security

How to remove Splunk login page iframe?

dcascione
Explorer

Hello! I would like to understand what content should be displayed in the login page iframe and also how to remove it permanently (currently displaying an error). Any help would be greatly appreciated - Thanks!

iframe error

0 Karma
1 Solution

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

View solution in original post

chris24747
Explorer

Hi, no need for hacking js files, it's an option in web.conf:

updateCheckerBaseURL = http://quickdraw.Splunk.com/js/

  • Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com for new versions of itself.

so :
[settings]
updateCheckerBaseURL=0

dcascione
Explorer

Thanks for the alternate answer. I reverted my changes and updated the [settings] option as you described above!

0 Karma

lycollicott
Motivator

Hmm, I wonder if it is the update check.

Has anyone modified these files?
share/splunk/search_mrsparkle/exposed/css/login.css
share/splunk/search_mrsparkle/exposed/js/login.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/IFrame.js
share/splunk/search_mrsparkle/exposed/js/views/account/login/updatechecker/Master.js

dcascione
Explorer

Yes! Navigating here: share/splunk/search_mrsparkle/exposed/js/login.js

I changed the url from "http://www.splunk.com/r/download" to just "" and it resolved the issue.

template: '\
                <a href="http://www.splunk.com/r/download" class="btn"><%= _("Download").t() %></a>\
                <a href="#" class="skip"><%= _("Skip update").t() %></a>\

Thanks!

lycollicott
Motivator

This isn't much to go on. What's your browser? What's in your web.conf? Specifically the login_content line?

0 Karma

dcascione
Explorer

Hello - For some reason the description I added along with the photo isn't showing - my apologies. Basically I want to know where the login page is located on the Splunk Enterprise Search Head and how to remove the iframe imbedded in the page. Right now its displaying the error finding the page to fill the iframe. We are currently using IE11. Thanks!

0 Karma

lycollicott
Motivator

I believe that is dynamically generated content by a combination of json, js and css.

Do you have a "login_content" line in either system/default/\web.conf or system/local/web.conf ?

That line specifies what is to be auto generated and your screen shot sort of looks like "login_content" might be set something invalid.

0 Karma

dcascione
Explorer

Found the line in systems/default/web.conf

Custom content for login screen

login_content =

Tried to comment out the reference and reboot the system with no change.

0 Karma

dcascione
Explorer

changed to login_content = false and now I see the word "false" above the blank iframe!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...