Security

Why is my Splunk login page advertising for .conf? How do I stop this?

Jason
Motivator

Why is my Splunk installation giving me a banner advertisement for .conf?

I know the Splunk conference is a great resource, but I (may have) paid for this system and it has no right to show advertisements to me and my users without my consent.

Can I disable this?

Tags (2)
1 Solution

Jason
Motivator

[Update] It appears this only affects installations running the Enterprise Trial license. If you still think this is un-Splunk-like behavior, please upvote to send that message!

--

Yes, you can disable it.

What you are seeing is a message from the Splunk upgrade checker tool which, oddly, now has a message from Splunk Marketing.

You can get more information about the checker here and turn it off following the advice in this answer. Add the updateCheckerBaseURL = 0 under [settings] in a web.conf. I advise putting the web.conf in an app if you are deploying other settings via an app. You can also put it in etc/system/local.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Jason,

I had the same issue. The fix was not to disable the checker, rather, I pointed the search heads affected to our master license server. Because we have an Enterprise license, the message went away once we associated each Splunk instance with our Enterprise license. It is important to do this, as if you recently installed the instance, it defaults to a 60 day Enterprise Trial, and you will lose functionality after that Trial ends. It would be wise to check your installs, and make sure they are associated with your Enterprise License. If it still shows up after you have the license installed correctly, you will need to contact Support and tell them as such.

Jason
Motivator

Tested and confirmed with an Enterprise license, that it does not appear. There is no logon on Free, so that leaves Trial only. Good spot!

0 Karma

Jason
Motivator

Thanks. I recently heard from Marketing that it's a test and they will stop if too many people object. Good to hear it is not enabled for Enterprise customers - I was testing it only on my demo instance (Enterprise Trial).

0 Karma

Jason
Motivator

[Update] It appears this only affects installations running the Enterprise Trial license. If you still think this is un-Splunk-like behavior, please upvote to send that message!

--

Yes, you can disable it.

What you are seeing is a message from the Splunk upgrade checker tool which, oddly, now has a message from Splunk Marketing.

You can get more information about the checker here and turn it off following the advice in this answer. Add the updateCheckerBaseURL = 0 under [settings] in a web.conf. I advise putting the web.conf in an app if you are deploying other settings via an app. You can also put it in etc/system/local.

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...