Alerting

View results email link leads to 404 Not Found

R15
Communicator

One of my alerts is having an issue with the email link to the results not working. I get a 404 that says Oops. Page not found!
I'm the admin, so I don't think it's a permissions issue. Other alerts from the same app are working fine. Any ideas?

Labels (1)
0 Karma
1 Solution

R15
Communicator

The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. 

In /apps/<app_name>/local/app.conf add:

[ui]
is_visible = true

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is probably something wrong with the way you have set up the search for the alert.

0 Karma

R15
Communicator

Can you elaborate on that? The search works fine on its own, and if the search was bad why would that cause the web page to not load? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Perhaps if you elaborate on what your search is for your alert we might be able to help spot the issue?

0 Karma

R15
Communicator

The search is very basic. The system is isolated so I can't copy/paste but it's just searching for one event code, action, and signature and tabling the results. There is nothing unique or unusual from other alert searches.

I don't understand how anything in the search string would cause a 404 error. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not really the search, it is how you set up the link in the alert.

0 Karma

R15
Communicator

I haven't messed with that at all, I simply have the box checked for Link to Results. 

0 Karma

RanjiRaje
Explorer

Hi, I am facing the same issue. did you find any solution ? 

0 Karma

R15
Communicator
0 Karma

R15
Communicator

The issue came up again with only one alert. The app it's in had been set up with the fix to use request.ui_dispatch_app = search but when clicking the view results link in the email it was still going to the same app. I made the app visible and the page now loads. 

In /apps/<app_name>/local/app.conf add:

[ui]
is_visible = true
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @RanjiRaje 

Rather than trying to piggyback on someone else's issue, please start a new topic in Answers with details of your specific usecase, what you have tried so far, and the issues you are facing.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...