I just tried to test the example provided at
I created the myapp/default/savedsearches.conf with the contents
then added the input to the myapp/defaut/inputs.conf. Finally created the myapp/default/setup.xml EXACTLY as mentioned.
All I got was this when prompted to view setup
404 Not Found
Splunk cannot find "apps/local/myapp/setup".
This page was linked to from http://192.168.0.200:8000/en-US/app/myapp.
You are using 192.168.0.200:8000, which is connected to splunkd @98164 at https://127.0.0.1:8089 on Tue Aug 9 16:36:04 2011.
I find it a bit odd that such a simple example provided on the splunk website would fail like this?
I am running Splunk on windows if that makes any difference.
I found the issue by looking in splunkd.log
It was this line from the setup.xml
'WebSearch' should be 'Web Search'
I highly recommend someone update the public website. While its a simple mistake it is incredibly frustrating trying to use documented demos which dont work. Then trying to debug something you are learning at the same time.
Docs and error system could also be more clear that the setup.xml blocks must be wrapped in "
they don't say that or show that in their examples.
I'm facing similar kind of issue and not able to find any solution.I have followed all the given instructions and prepared the following conf files.
<setup> <block title="User Dashboard Configuration" endpoint="userinput/user_input" entity="dashboard_conf"> <input field="dashboard_url"> <label>Dashboard URL</label> <type>text</type> </input> <input field="auth_token"> <label>Authentication Token</label> <type>text</type> </input> </block> <block title="Syslog Configuration" endpoint="userinput/user_input" entity="syslog_conf"> <input field="slog_port"> <label>Syslog Port</label> <type>text</type> </input> </block> </setup>
[admin:user_input] match=/userinput members=user_input [admin_external:user_input] handlertype = python handlerfile = user_input_setup.py handleractions = list, edit
[dashboard_conf] dashboard_url = https:// auth_token = [syslog_conf] slog_port =
While I try to open the setup page from Manage Apps -> Set Up, it gives me 404 page not found error (web_service.log). I dont know what I'm missing here. It is not even opening setup page dialog box.
INFO [58eaa49e4d11014cc90] error:138 - Masking the original 404 message: 'Nothing matches the given URI' with 'Page not found!' for security reasons
setup.xml pages are incredibly finicky and the _internal logs are almost barren with information about why they fail.
My only recommendation would be to start with a known working example then gradually change it piece by piece testing with every change until it is configured how you want it.
From your example verify that the endpoint exists on your Splunk instance. That is the only suspect thing I can see in your example above.
Normally they would be located somewhere like here
<setup> <block title="Proxy Server Details" endpoint="admin/myCustomApiSettingsEndpoint" entity="web_proxy"> <input field="proxy_address"> <label>Proxy Address</label> <type>text</type> </input> <input field="proxy_username"> <label>Proxy Username</label> <type>text</type> </input> <input field="proxy_password"> <label>Proxy password</label> <type>text</type> </input> <text>This password will be encrypted in Splunk's password store. If left blank the password will remain unchanged.</text> </block> <block title="Warning"> <text>If you change the username you will need to reenter the password as it is stored internally against the username.</text> <text>Please be patient and wait for this form to complete before navigating away from this page.</text> </block> </setup>
I checked some applications from Splunk base, and having same configuration and still works. Splunk base apps don't have any admin endpoint.
Fair enough. Which apps so I can have a look too?
Like I said nothing stands out as wrong with your config. Without more details from Splunk logs the only logical way to resolve is to start with a working demo config and change one thing at a time testing each change until you get to where you want.
It shouldn't take more than an hour to do that so it is worth a try.
At one point you will find the bit that breaks. Then please post here so we can all learn from it.