Splunk Web Image upload Error(8.0.1)

[openpath_llc]

Hi All,

When attempting to upload a custom background image on 8.0.1. It fails and gives and internal server error(seen from web-developer tools(safari)...

I uninstalled that version and went to 7.3.3 and it works fine. I wasn't sure if this is a bug or something already reported. I've attached the images from the error I got.

[niketn · Accepted solution]

@openpath_llc this seems to be a bug in Splunk 8.x where /api/manager/uploadbgimg REST API call is not working. Hence background image is not getting uploaded.

You can do this from the back-end by editing the web.conf in the system/local folder: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomizeLogin#Customize_the_login_p...

[settings]
loginBackgroundImageOption = custom
loginCustomBackgroundImage = search:logincustombg/<yourImageFile>.<yourImageFileType>

And manually upload the background image to the following path:
$SPLUNK_HOME\etc\apps\search\appserver\static\logincustombg\<yourImageFile>.<yourImageFileType>

PS: Do Splunk Restart/Refresh and browser cache cleanup for the changes to take effect.

Another workaround if you are already on Splunk 7.3.x then you can update the image from UI and then upgrade to Splunk 8.x but using back-end to update the background image is a better approach.

[JasonCMurray]

Thanks - this is exactly what I needed to post new starting page graphic that include the required corporate consent notification.

[openpath_llc]

Thanks @niketnilay. I am aware of this, I just figured I would bring it up since I didn't see it in the known issues. Cheers.

[jkat54]

We need more details. The internal server error should be corroborated by some logs on the backend.

Could be anything from disk space to permissions to who knows what.

We'd need many more details to determine if this is a bug or not.

[openpath_llc]

I am going to try to replicate the error again shortly.

This is what I did before.

Spun up new ec2 instance
Install Splunk 8.0.1
Attempted to change login_background via GUI(fail)
fail message----internal server error---
Stop Splunk and install older Splunk version(7.3.3) on same server
Attempt to change login_background via GUI(success) on same server

[jkat54]

Try running this search to find the 500 errors in the access logs. If found, zoom to the time when they did occur and remove the sourcetype=splunk*access and add log_level=warn* OR log_level=error. You should be able to find the culprit like that.

index=_internal sourcetype=splunk*access status=500

[richgalloway]

Have you tried a different browser?