Splunk kubernetes (EKS) cluster getting constant "Your session has expired. Log in to return to the system." error
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 549
- Forks
- 277
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 2
Description
This issue I am seeing is identical to this issue that was posted a while ago by someone else but I don't believe the reason behind their problem applies to my situation so I am asking again.
What I am doing is I am creating a Kubernetes (EKS) cluster in AWS to run Splunk on and just to get a barebones example of it running I have been following this tutorial pretty closely. The main difference between my implementation and the one shown in the tutorial is I have a very simple load balancer service set up in the cluster which has an external IP I can access the Splunk web UI from.
When I access the Splunk web UI, I log in with the default credentials and it then gives me the error "Your session has expired. Log in to return to the system." I tried to clear my browser cache, tried a different browser, had a coworker try on his machine, and got off my company's VPN and none of these things resolved the issue.
From the few resources I have seen online about this error, it seems like there was some issue where this error occurs if there are more than one docker containers running on the same host which breaks the session-key cookie and gives this error. To my knowledge there is only one docker image running and I even reduced the instances in my cluster from 2 down to 1 and still have this issue.
Any guidance on this problem would be really helpful and I can provide as much information as needed on my setup. I am pretty new to Splunk in general and on top of that there is very little information online when it comes to using Kubernetes with Splunk so I'm hoping this is a good place to ask these questions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are identified. Start by reproducing the deployment from the linked Splunk tutorial on an AWS EKS cluster, then compare the load balancer and single-container setup with the linked issue's session-cookie explanation. Done means identifying the cause of the expired-session error and documenting a verified resolution.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, kubernetes
- Domain
- authentication, cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100