Splunk on SUSE with Firefox 3, forever loading…

If you’re using SLES or any other Suse variant you might be wondering why your Splunk installation is constantly in a loading loop unless you browse to it using Internet Explorer. After lots of hacking around, reboots and google searches I emailed the splunk team about my problem. At first they didn’t seem to understand my problem but they did suggest I take a look at this article in their troubleshooting documentation.

http://www.splunk.com/doc/latest/admin/UnableToGetAProperlyFormattedResponseFromTheServer

It appears that there’s some kind of mime type issue where either the input/output is munged because SUSE incorrectly identifies it. It results in a “loading dashboard…” showing up for a long time and after that.

Your search is still running after 1 minute. Unless you have set a high maxresults:: value, check if the Splunk Server is up and responding

The fix is actually quite easy, I’ll just repost it here just in case the link I provided becomes bad later.

Unable to get a properly formatted response from the server

Users running Splunk on a SuSE 10.x server may receive the error message Unable to get a properly formatted response from the server; canceling the current search when executing any kind of search.

In order to resolve this issue edit /etc/mime.types. Delete (or comment out) these 2 lines:

text/x-xsl xsl
text/x-xslt xslt xsl

Also change this line:

text/xml xml

to:

text/xml xml xsl

With these changes in place, restart Splunk and clear your browser cache.

Leave a Reply