https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22787#M3971 <P>No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:</P> <P>If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.</P> <P>What should I put in web.conf exactly, regarding the URIs?</P> Mon, 28 Sep 2020 12:44:37 GMT lrhazi 2020-09-28T12:44:37Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22782#M3966 <P>With all saved searches, I get this error when I try to run them:</P> <P>The saved search <CODE>"%2FservicesNS%2Fnobody%2Fsearch%2Fsaved%2Fsearches%2FErrors%2520in%2520the%2520last%252024%2520hours" could not be found.</CODE></P> <P>am using Splunk 5.0</P> <P>Also, when I first create a search, the popup wizard give this error:</P> <PRE><CODE>500 Internal Server Error Return to Splunk home page ResourceNotFound: [HTTP 404] <A href="https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03" target="test_blank">https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03</A>; [] </CODE></PRE> <P>The search is effectivily created, as I can see iet later on in the drop down and in Saved Searches....</P> <P>am thinking these two issues are related...<BR /> I must be missing some setting that helps the GUI know it is now running behind a proxy.<BR /> But which setting is it?</P> Sun, 04 Nov 2012 18:11:30 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22782#M3966 lrhazi 2012-11-04T18:11:30Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22783#M3967 <P>It may be easier to advise you if you indicated what configuration you did perform, and how exactly you and your proxy access Splunk.</P> Mon, 05 Nov 2012 02:09:52 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22783#M3967 gkanapathy 2012-11-05T02:09:52Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22784#M3968 <P>Not sure what you mean by "what configuration you did perform". My proxy is what I believe to be a typical apache proxy config, performing ldap auth and forwarding traffic to localhost:8000 where splunk web is running by default.</P> Mon, 05 Nov 2012 04:44:39 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22784#M3968 lrhazi 2012-11-05T04:44:39Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22785#M3969 <P>So, you did <EM>no</EM> configuration to tell Splunk that you are behind an SSO proxy.</P> Mon, 05 Nov 2012 04:46:45 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22785#M3969 gkanapathy 2012-11-05T04:46:45Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22786#M3970 <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Security/ConfigureSplunkSSO">http://docs.splunk.com/Documentation/Splunk/5.0/Security/ConfigureSplunkSSO</A></P> Mon, 05 Nov 2012 04:46:52 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22786#M3970 gkanapathy 2012-11-05T04:46:52Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22787#M3971 <P>No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:</P> <P>If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.</P> <P>What should I put in web.conf exactly, regarding the URIs?</P> Mon, 28 Sep 2020 12:44:37 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22787#M3971 lrhazi 2020-09-28T12:44:37Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22788#M3972 <P>To be clear, I did some configuration, and it is exactly the document you linked. I am sure I missed something though, but what is it?</P> Mon, 05 Nov 2012 05:09:03 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22788#M3972 lrhazi 2012-11-05T05:09:03Z https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22789#M3973 <P>Support tells me this a bug related to SSL:</P> <BLOCKQUOTE> <P>SPL-57518 has been assigned to this<BR /> issue. It happens because there is<BR /> wrong uri encoding from splunkweb when<BR /> using SSL.</P> </BLOCKQUOTE> Tue, 06 Nov 2012 20:12:32 GMT https://community.splunk.com/t5/Splunk-Search/Saved-searches-issue-with-SSO/m-p/22789#M3973 lrhazi 2012-11-06T20:12:32Z