topic Why am I getting a "404 Not Found Page not found!" error when an app is invisible? in Security

Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

rphillips_splk — Tue, 14 Jun 2016 00:10:18 GMT

Several UI links produce the 404 Not Found (Page not found!) when an app is invisible.

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search

The problem is reproducable when an app is invisible and you try and:

edit an alert action of a scheduled search which lives in an invisible app "Click to edit actions"
click "run" from a saved search in an invisible app
"Click on saved search name from the "View recent" page" of a search that lives in an invisible app

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

rphillips_splk — Tue, 29 Sep 2020 09:57:14 GMT

Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)

Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app

Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error

Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns

404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11

So, here replace the test_app_1 custom app name with search to make it look like:

http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11

and load it on a different browser tab because you cannot modify the URI of the view recent page.

These issues are being tracked under internal Splunk bug: SPL-97879

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

woodcock — Tue, 14 Jun 2016 14:01:02 GMT

Great research! You need to click "Accept".

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

reswob4 — Fri, 26 Aug 2016 15:33:42 GMT

This is nice, but for automatic searches that output to a lookup table, it puts those tables into the Search & Reporting app instead of the hidden app.

Just started playing with it so I don't have a suggestion for a fix yet outside of manually moving the resulting lookup tables into the hidden app, which may involve manually deleting the current tables and replacing them with the new ones.....

EDIT: Looks like I spoke too soon. I just reviewed the results via sideview utils and the confirmed via ssh and those lookup table csv's are created in the hidden app.

apologies

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

kranzrm — Sun, 04 Jun 2017 05:29:43 GMT

Still seeing this problem in 6.5.3 but not for all saved searches. Click on Run for a saved search in a hidden app and get the 404.