TrackMe bug report - something does not look right

[ttomans]

Describe the bug Menu bar is missing when using Reverse Proxy Mapping when connecting to SH Cluster.

To Reproduce Steps to reproduce the behavior:

1. accessing TrackMe app
2. Landing in Track me page shows the dark gray bar empty, without any text buttons.

Expected behavior When I use to connect direclty on a SHCL node without RPM the menu bar is back again TrackMeTrackMe MobileTrackMe QOSTrackMe manage and configureMaintenance modeSearchAPI & toolingCollectionsAuditHelp

Screenshots

Splunk version and deployment:

• Splunk Enterprise Version: 8.1.4
• TrackMe Version:1.2.53 Build: 1629190321
• Search Head Cluster (SHC)

[guilhemmarchand]

Hi @ttomans

As far as I am concerned, this isn't an application level issue, but a configuration side issue with your reverse proxy configuration.

Facts:

• Going straight to Splunk Web bypassing the RP works as expected
• The navigation bar for instance in the application is a pure builtin Splunk app level thing, nothing especial for TrackMe, if it doesn't work via the RP then you have big problems widely with any other app too

From my experience, you need to review:

• Session stickyness: when going through LB / RP, you need to make sure the traffic of a single user session sticks on the same SHC member, I would strongly suspect this is where you issue stands
• advanced settings: I had seen by the past issues with LB/RP limiting the size of the URL, size of requests and those kind of things leading to similar weirdness, double check your settings

In any case this is an infrastucture level configuration issue.

Guilhem

[ttomans]

Thank you so much for your prompt reply and for the details. I will review those RP settings. I still wonder why the application works fine, but only that menu bar has this issue.

cheers, Tomans

[guilhemmarchand]

Hi @ttomans

Yeah it's suspicious, is it happening only with TrackMe?

By safety, make sure you do not have a local copy of the default/data/ui/nav/default.xml, either in local or on the user level. A broken xml can lead to this but as you mentioned not seeing the issue while not via the RP that shouldn't be the case.

[guilhemmarchand]

Any update @ttomans ?

[ttomans]

Hi @guilhemmarchand, no updates so for; work in progress on the RP thingy.

[guilhemmarchand]

Thanks @ttomans

When you load the application, click on inspect in your Web Browser then checkout the console and errors, you likely would see some errors with HTTP 404 or things or like that. This would provide some additional contexts.

You will likely see errors in Splunk Web access logs too. (in the _internal or _audit, checkout access logs)

[ttomans]

In the console I see some errors related to index.js

/en-US/splunkd/__raw/servicesNS/-/trackme/saved/searches?output_mode=json&search=NOT+((federated.provider!%3D%22%22))+AND+is_visible%3D1+AND+disabled%3D0&count=500&_=1635281733887 net::ERR_CONNECTION_RESET 200 (OK)

/en-US/static/@17f862b42a7c/build/simplexml/4.js net::ERR_CONNECTION_RESET 200 (OK)

as for the access log this is the only GET with 404 "GET /servicesNS//trackme/data/ui/viewstates/TrackMe%3A_current HTTP/1.0" 404 159 "-" "Python-httplib2/0.13.1 (gzip)" - 9ms