All Apps and Add-ons

How to resolve the error "Cannot get username when all users are selected"

mouryagalla
Explorer

I am getting error "Cannot get username when all users are selected" on the splunkweb when i ran any search. I have tried deleting cookies, it didnt work. I am using AWS ELB for load balancing the 3 clustered indexers. Is there any issue regarding load balancing configuration?

1 Solution

mattymo
Splunk Employee
Splunk Employee

Hi mouryagalla!

I solved this issue with a client by ensuring that the the load balancer (f5 in our case), sitting in front of our search head cluster, had session persistence set.

https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/UseSHCwithloadbalancers

"Configure the load balancer so that user sessions are "sticky" or "persistent." This ensures that the user remains on a single search head throughout their session."

quick google led me here:

http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-sticky-sessions.html

Just to clarify, you mention you are load balancing the 3 clustered INDEXERS?

Does this just mean you are load balancing the splunk web sessions (ie port 8000) to these indexers? Or are you sitting an LB in front of your indexing port (ie 9997) ?? (this is generally a "No-No").

- MattyMo

View solution in original post

maraman_splunk
Splunk Employee
Splunk Employee

just had the same error message on a standalone test instance in a VM.
looking at internal log, the root cause is disk space

0 Karma

mattymo
Splunk Employee
Splunk Employee

Hi mouryagalla!

I solved this issue with a client by ensuring that the the load balancer (f5 in our case), sitting in front of our search head cluster, had session persistence set.

https://docs.splunk.com/Documentation/Splunk/6.6.3/DistSearch/UseSHCwithloadbalancers

"Configure the load balancer so that user sessions are "sticky" or "persistent." This ensures that the user remains on a single search head throughout their session."

quick google led me here:

http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-sticky-sessions.html

Just to clarify, you mention you are load balancing the 3 clustered INDEXERS?

Does this just mean you are load balancing the splunk web sessions (ie port 8000) to these indexers? Or are you sitting an LB in front of your indexing port (ie 9997) ?? (this is generally a "No-No").

- MattyMo

mouryagalla
Explorer

Hi mmodestino!
Yes, I'm load balancing the splunk web sessions (ie port 8000) to these indexers.
I have checked with my client and ensured the stickness enabled by doing following configurations:

To enable duration-based sticky sessions for a load balancer using the console

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
  2. On the navigation pane, under LOAD BALANCING, choose Load Balancers.
  3. Select your load balancer.
  4. On the Description tab, choose Edit stickiness.
  5. On the Edit stickiness page, select Enable load balancer generated cookie stickiness.
  6. Choose Save.

But still the error is not resolved..

0 Karma

mattymo
Splunk Employee
Splunk Employee

did you ensure to log out of all the SH and clear your browser cache? Just a thought.

Would have to look into the aws elb configs to understand if the settings you shared are enough. Will try and have a look.

- MattyMo
0 Karma

mouryagalla
Explorer

I have ensured logging out all SH and also cleared browser cache. It did not work.

I have a doubt- when the load balancer bounces to other node(server) why is it not prompting to splunk login page?

0 Karma

mouryagalla
Explorer

Thanks mmodestino! Issue resolved by including duration based stickiness settings in the AWS ELB. Previously, Our AWS team configured these settings to different ELB.

0 Karma

mattymo
Splunk Employee
Splunk Employee

ha! thats funny, our LB team thought they configured it too, and had to go back and double check! Glad you are up and running!

- MattyMo
0 Karma

mattymo
Splunk Employee
Splunk Employee

Because it should be an authenticated session not requiring login....did you get it fixed?

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...