Why are we getting error "ResourceNotFound...Application does not exist: user-prefs" trying to access Splunk?

[Kaushikkatta03]

We are getting these internal errors when we are trying to access Splunk.

500 Internal Server Error 

 Return to Splunk home page 

 ResourceNotFound: [HTTP 404] https://**************/services/data/user-prefs; [{'type': 'ERROR', 'code': None, 'text': 'Application does not exist: user-prefs'}] 

[splunk_force_as]

Looks like the user-prefs app is missing. If you go to $SPLUNK_HOME/etc/apps, do you see a directory called user-prefs? If not, that's more than likely the issue. I would download another copy of Splunk Enterprise, whatever version you are running, and copy the user-prefs app from there to your current $SPLUNK_HOME/etc/apps. Or you could upgrade or reinstall.

[ryanoconnor]

Do you have the Splunk Universal Forwarder and Splunk Enterprise on this machine?

[Kaushikkatta03]

yes ,we have Splunk universal forwarder and splunk enterprise

[ryanoconnor]

I'm wondering if your Splunk Universal Forwarder is binding to the Splunk web port on accident. Is there a reason you have these both installed side by side? If Splunk Enterprise is installed on a machine there is generally no need for a Universal Forwarder.

Try stopping the UF and Splunk Enterprise and just starting Splunk Enterprise and see if this changes anything.

[somesoni2]

What version of Splunk are you using and are you using Splunk Enterprise?

[Kaushikkatta03]

yes it splunk enterprise , version : splunk 6.0.3