Splunk reverts back to dashboard on its own (from search) - Unwanted Web Refresh

[axsolis]

Hello,

When using splunk in Firefox, the Web Interface will “refresh” and go back to the Summary Dashboard on its own. Whatever I was working on is lost and I have to restart my searching. The Splunk web interface does this at least once an hour and is very annoying. It does not seem to be tied to inactivity since I have actually been in the middle of paging through search results and out of nowhere I lose the search page and am presented with the Summary Dash Board

Does anyone have any idea what is happening and how I can fix it? I am using Splunk Free version 4.1.5(85165).

Thanks!

[axsolis · Accepted solution]

I think I found the solution......

It turns out my web browser was using a web proxy for all connections, even intranet connections. Once I placed the URL of my splunk web server in the proxy exceptions list, this issue went away. I guess the proxy resets connections after a certain idle time.

Thanks for everyone who answered!!

Alex

[sideview]

It's a bit of a guess, but are you using the BreadCrumb module? The BreadCrumb module has some very regrettable special-cased code in it that looks for searches being cancelled and if it sees one it tries to 'go back'. (It was definitely not one of my brighter moments when I put this in; it was needed for report_builder but putting it in the module was an awful idea)

Basically whenever I use the BreadCrumb module I have to patch it from application.js to not do that. You can see how to do this by pulling down the 'Splunk Discover Alpha' app from splunkbase and looking at /etc/apps/discover/appserver/static/application.js. There's a block of code in there patching Splunk.Module.BreadCrumb and I think i even left some comments explaining what it's doing.