topic Re: URLs in alerts are correct but being routed to the wrong app and returns 404 in Alerting

URLs in alerts are correct but being routed to the wrong app and returns 404

neiljpeterson — Fri, 30 May 2014 21:08:30 GMT

Generated links in alerts are being routed to an old name of an app even though the path is correct.

The name change was just a change in case (eg MyApp to myapp) because it was causing an issue with savedsearches.conf

Now when an alert goes out the link is (spaces added to escape auto-formatting)

https:// splunk.domain. net/app/myapp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

HOWEVER the browser is actually routed to

https://splunk.domain.net/app/MyApp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

I reinstalled the app, restarted the server and did a /debug/refresh the links still are not working correctly.

What are my next steps?

Re: URLs in alerts are correct but being routed to the wrong app and returns 404

MuS — Mon, 02 Jun 2014 13:37:36 GMT

Hi neiljipeterson,

did you check app.conf in your app directory does that match the new name, also check if the directory in $SPLUNK_HOME/etc/apps/ matches the new name.

I just did a test renaming my test app mySandBox to myfooBOX by changing the label in app.conf but not changing the directory in $SPLUNK_HOME/etc/apps/. So now my app is labeled myfooBOX in Splunk but the URL is still pointing to http://mysplunkserver/en-US/app/mySandBox/search ...

hope this helps ...

cheers, MuS

Re: URLs in alerts are correct but being routed to the wrong app and returns 404

neiljpeterson — Mon, 02 Jun 2014 19:05:16 GMT

No, the app label still has the capital letters. I would like to leave it that way. But just for testing I did change it and it does not seem to have an effect on the URL, nor would I expect it to. Most apps have different labels than their physical paths, right?

Yes, the physical path is correct and has the new name.

Re: URLs in alerts are correct but being routed to the wrong app and returns 404

neiljpeterson — Mon, 02 Jun 2014 19:19:23 GMT

So I found the issue here.

There was a duplicate stanza in $SPLUNK_HOME\etc\users\my.user\myapp\local\savedsearches.conf that had the old app name for request.ui_dispatch_app

This stanza was trumping the stanza in app directory.

I think this happened because I manually copied the savedsearch to the app directory but forgot to remove it from my user\app\local directory.

A great lesson in conf file order of precedence.

Re: URLs in alerts are correct but being routed to the wrong app and returns 404

MuS — Tue, 03 Jun 2014 05:36:09 GMT

nice done 🙂