Splunk Cloud Platform

Why does my Splunk web keep auto-refreshing?

shrikant0013
Explorer

Has anyone experienced continuous automatic refreshing of Splunk (web console) dashboard or apps including searching.

When I visit Splunk console and try to navigate to any app or dashboard or even management console. It keeps refreshing every 2/3 seconds. I started noticing this behavior suddenly. I tried following

  • Restart Splunk
  • Restart VM
  • Verify CPU/Disk/Network usage, all seems within acceptable range in fact way under control

Splunk deployment

  • Single Node on big vertically scaled instance (32GB RAM, 8vCPU cores)
  • Splunk v7.0.4 on linux x64 Apps
  • Splunk App for AWS, AWS add on
  • Daily ingestion ~35GB
  • Browser - Chrome

ivolazy
New Member

Seems like a Splunk bug with SSO when the dashboard has panels configured for auto-refresh.

Just clear your browser cached cookies and all Splunk tabs will stop auto-refreshing

0 Karma

Genti
Splunk Employee
Splunk Employee

SPL-177705

specifically, you might be seeing lines like so:

10-29-2019 11:07:25.865 -0700 ERROR UiAuth - Request from 10.209.0.34 to "/en-US/splunkd/__raw/servicesNS/someperson/someapp/search/jobs" failed CSRF validation -- expected "6641867248537937813", but instead cookie had "6641867248537937813" and header had "10543209232131847267"

from what I see, fixed in 7.2.10 and definitely fixed in 7.3 according to bug tracking

0 Karma

jawaharas
Motivator

Try increasing connection timeout between the browser and Splunk web as below in web.conf and restart the Splunk instance:

Default:

 server.socket_timeout = <integer>
 * The timeout, in seconds, for accepted connections between the browser and  Splunk Web
 * Default: 10

Proposed:

 server.socket_timeout = 60

burwell
SplunkTrust
SplunkTrust

This happens for us with Splunk when the SSO tokens expire as stated above. We need to refresh our tokens and get new windows. They refresh is maddening, especially since you could start to modify a search and then a refresh happens and you lose what you just typed.

0 Karma

ashutoshab
Communicator

If not just 'a dashboard' but 'all the screens of Splunk' are refreshing frequently, the first possibility is because of the SAML / SSO authentication. Please connect with your SAML provider team to check if your SSO is trying to refresh tokens frequently in your browser.

If it's only on the dashboard and not anywhere in Splunk, it is happening because of the refresh interval in the dashboard XML.

0 Karma

Omarop
Loves-to-Learn Lots

My dashboards continue to refresh every second and I tried every browser and it didn't work. Has anyone else come across this issue? Your help will be gladly appreciated.

0 Karma

ddrillic
Ultra Champion

Can you please check the source code of your dashboads and see whether you have something like <dashboard refresh="X"> or <form refresh="30">?

0 Karma

Omarop
Loves-to-Learn Lots

Splunk user interface keeps refreshing. Is anyone else having the same problem? If so, can you please provide assistance to have this matter resolved. Your help and feedback is greatly appreciated.

Thanks,

Omar

0 Karma

ddrillic
Ultra Champion

What exactly is refreshing? maybe a screen-shot...

0 Karma

Omarop
Loves-to-Learn Lots

My dashboards.

0 Karma

brenthale
Explorer

The entire tab is refreshing. It'd have to be a movie to show the refresh. 🙂

0 Karma

ddrillic
Ultra Champion

I see @brenthale ; - ) I had a similar case at Does a dashboard keep refreshing itself by default?

Does it make sense?

0 Karma

brenthale
Explorer

Often it is not a Dashboard but a simple Search page with a query that is refreshing. I've seen it refresh in both instances.

0 Karma

matt_park
Explorer

What sort of authentication are you using? Seeing this with SSO/SAML and my suspicion is it might be a page element attempting to establish a new session (I could be wrong).

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hey @shrikant0013,

Check out this post, and see if there is any information in there that answers your question.

Thanks for posting!

0 Karma

shrikant0013
Explorer

I did some google searching and had come across this post. That post talks about custom dashboard. I notice this behavior on default Splunk dashboards/pages as well

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi @shrikant0013,

this might not be a problem of splunk, but the problem of your webbrowser.
What you describe is actually a problem that already happened with browsers before.

Just google "How do I stop name of your browser from refreshing pages constantly? "

0 Karma

brenthale
Explorer

I get this problem as well. It only seems to happen with Splunk dashboards or Searches; other web-pages are not getting refreshed. It seems to be limited to Splunk pages.

This is annoying when it gets into this mode. Sometimes I can simply copy the URI, close the tab, open a new tab and paste in the URI and it is ok. But I'd rather not do that.

0 Karma

brenthale
Explorer

Here is an update to what I am seeing.

I just got into the refresh behavior again. This time I made it go away by closing down a lot of tabs in my browser window. I had ~20+ tabs open in each of 3 separate Chrome windows (don't judge me). Once I closed a bunch of tabs the refresh problem stopped happening.

Yes, I have too many tabs open. But refreshing Splunk windows doesn't seem like it should be happening either.

0 Karma

shrikant0013
Explorer

Thanks for the comment. I do not experience this behavior for other sites Also my team mates has same experience on his laptop and browser.

I have another Splunk Instance (similar config but used for staging/test with few events). This one seems fine.

Also if it helps, auto refreshing is aggressive initially when page is loading to calms down as the page gets loaded in few minutes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...