topic Re: Unable to Export to CSV with error "File not found" in Getting Data In

Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 13:36:20 GMT

Hi Guys

Can anyone advise on this? I'm running a search in 6.2.4, but no matter what browser, Firefox, Chrome or IE, when exporting to CSV, I get the below error:

File not found

Firefox can't find the file at https://servername:8000/en-US/api/search/jobs/1442409455.83703/event?isDownload=true&timeFormat=%FT%T.%Q%:z&maxLines=0&count=0&filename=Test Export&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000.

    Check the file name for capitalization or other typing errors.
    Check to see if the file was moved, renamed or deleted.

there are only 230 results so this is by no means a large csv that is being created to export.

Re: Unable to Export to CSV with error "File not found"

jclehmuth — Wed, 16 Sep 2015 14:09:27 GMT

Are you using the export button or outputing to a Lookup table?

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 14:10:31 GMT

im using the little downwards arrow icon to export

Re: Unable to Export to CSV with error "File not found"

jclehmuth — Wed, 16 Sep 2015 14:14:30 GMT

Sounds like it might be a permission issue (either Splunk or computer), have you exported anything before.

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 14:16:19 GMT

yeah other searches seem to work ok, just seems to be an issue with this one so far ??? source="/var/adm/syslog/syslog.log" host=SERVERNAME "abort"

Re: Unable to Export to CSV with error "File not found"

jclehmuth — Wed, 16 Sep 2015 14:22:06 GMT

Sorry, not sure what to tell you then, maybe there is a glitch in the matrx

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 14:23:08 GMT

no worries, thanks

Re: Unable to Export to CSV with error "File not found"

somesoni2 — Wed, 16 Sep 2015 14:29:20 GMT

Just to be sure, you freshly ran the search and tried to export, not that job is expired or something?

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 14:32:01 GMT

Nope I have ran it on a seperate search head as well as the indexer, logged off and back on and tried the different browsers, its very very odd

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Wed, 16 Sep 2015 15:01:41 GMT

Hey

So I ran the report again, waited for all the results to show and noted down the oldest result.

I then went ahead and ran the report again with specified dates so between the oldest date shown in the previous results up until today.

This time once the search had completed I was able to export without issue as expected, a work around of sorts I guess but why wouldnt it export the same data before ???

Re: Unable to Export to CSV with error "File not found"

tlelle_splunk — Wed, 16 Sep 2015 19:41:47 GMT

The strangest part that I see that could be part of the issue is the distinct space in your URL between Test and Export. I suspect that this could be the reason why the file can't be found (spaces must be encoded in URL's/URI's.)

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Thu, 17 Sep 2015 08:54:11 GMT

The break is from the name given to the file that's being exported so for example "Test Export" I did actually test that yesterday too, it didn't seem to make any difference if there were spaces or not.

Re: Unable to Export to CSV with error "File not found"

grijhwani — Thu, 17 Sep 2015 14:11:45 GMT

Spaces should be encoded as either "+" or "%20", but since Microsoft decided to blindly ignore the standard, everyone else has had to pretty much follow in their wake, and most browsers will forgive the abuse.

Re: Unable to Export to CSV with error "File not found"

grijhwani — Thu, 17 Sep 2015 14:13:41 GMT

Have you got some ridiculously short job retention time set, or any full disk partitions on the search head?

Re: Unable to Export to CSV with error "File not found"

tlelle_splunk — Thu, 17 Sep 2015 14:14:20 GMT

When I try to download a csv in the same manner that you did, and I include a space, the space is turned into an underscore ( _ ).

Re: Unable to Export to CSV with error "File not found"

bleinfelder — Thu, 29 Oct 2015 13:00:45 GMT

Hi there,

I had the same issue - successful search, export failed with "File not found" message as above (Splunk 6.2.0).

After some research we found out that the issue was caused by a dynamic lookup script, that provided data to the search. The lookup returned data in utf-8 (not sure on that, might be some latin as well) encoding, which was not handled correctly by splunk. We fixed the issue by removing all specials characters (german umlauts) from the lookup result.

Maybe this helps.

Bernd

Re: Unable to Export to CSV with error "File not found"

AaronMoorcroft — Tue, 03 Nov 2015 10:32:47 GMT

Thanks for the additional info, i've not seen this happen again yet, nor has it been reported to me again however if it is, ill investigate again with the above in mind,

Thanks

Re: Unable to Export to CSV with error "File not found"

proletariat99 — Tue, 20 Sep 2016 20:09:22 GMT

Splunk 6.3.3 and seeing the same issue. Successful search and failed with "File not found". Search is

index = <ix> sourcetype = <st> | eval blah = upper(blah) | search [| inputlookup <lookup>.csv | eval blah=upper(blah) | fields blah ]

Get the following message.

Firefox can’t find the file at https://<splunkserver>.com/en-US/api/search/jobs/1474401463.33913_EFCB204A-D5CA-495C-9E83-AA90B82DEFDA/event?isDownload=true&timeFormat=%FT%T.%Q%:z&maxLines=0&count=0&filename=things&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000.

Other searches export fine, other browsers also don't work. Any suggestions would be lovely.

Re: Unable to Export to CSV with error "File not found"

sparrowe — Wed, 02 Aug 2017 14:28:23 GMT

It may be that Splunk is rerunning the search to complete the export. You could confirm this by seeing "your search will be rerun" at the bottom of the dialog box (just below "Number of Results).

If so, it may take longer then 30 seconds with is the default timeout value which will result in a "File not found" error when using FireFox (i.e. shows an HTTP 500 error).

One option would be to modify the splunkdConnectionTimeout parameter in your web.cof file.