Alerting

View results email link leads to 404 Not Found

R15
Path Finder

One of my alerts is having an issue with the email link to the results not working. I get a 404 that says Oops. Page not found!
I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?

Labels (1)
0 Karma
1 Solution

R15
Path Finder

The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. 

In /apps/<app_name>/local/app.conf add:

[ui]
is_visible = true

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is probably something wrong with the way you have set up the search for the alert.

0 Karma

R15
Path Finder

Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps if you elaborate on what your search is for your alert we might be able to help spot the issue?

0 Karma

R15
Path Finder

The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches.

I don't understand how anything in the search string would cause a 404 error. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not really the search, it is how you set up the link in the alert.

0 Karma

R15
Path Finder

I haven't messed with that at all, I simply have the box checked for Link to Results. 

0 Karma

RanjiRaje
Explorer

Hi, I am facing the same issue. did you find any solution ? 

0 Karma

R15
Path Finder
0 Karma

R15
Path Finder

The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. 

In /apps/<app_name>/local/app.conf add:

[ui]
is_visible = true
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @RanjiRaje 

Rather than trying to piggyback on someone else's issue, please start a new topic in Answers with details of your specific usecase, what you have tried so far, and the issues you are facing.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...