Dashboard: "Open in Search" results in Error 500

[mkelderm]

Our Dashboards are working fine, even the ones delivered by Splunk App Base (like S.O.S., License app). But If we click on "Open in Search", we get a browser error 500:

500 Internal Server Error

Return to Splunk home page
Exception: If you specify sid (job id), you cannot also specify q or s (saved search name).

You are using splunk.nl.rsg, which is connected to splunkd @182037 at https://127.0.0.1:8089 on Thu Oct 24 11:03:37 2013.

We are using: Splunk 6.0

Any idea if this is a config issue or worked-as-designed?

Marc

[onthebay]

We often get a similar issue when apps are invisible; replacing app name with search as above allows the search to run. Can you run a regular search in the app context?

[polamarasetti]

even, i am also getting same error, but earlier it was working fine. i am using SPLUNK 6.0

[mkelderm · Accepted solution]

Issue has to do with 'old' 5.0 non-compatible app. We removed all add-on apps, used the defaults application. Then the issue did not occur. Later on we added the latest 6.0 compatible apps.

[mkelderm]

I found the reason. Our application (dashboards) is an global app. When you click on the 'Open in Search" it expects the search app. The generated URL is based the application:

When click on "Open in Search", it generates an URL:

https://splunk.nl.rsg/en-GB/app/x-i-bridge-Dash-Trend-App/search

Which Should be:

https://splunk.nl.rsg/en-GB/app/search/search

[melting]

Default is that the search page is shared globally. Is this true in your case?

[mkelderm]

It is not an answer, but a finding

[mkelderm]

Anyone an idea to fix this URL?