Can anyone advise on this? I'm running a search in 6.2.4, but no matter what browser, Firefox, Chrome or IE, when exporting to CSV, I get the below error:
File not found Firefox can't find the file at https://servername:8000/en-US/api/search/jobs/1442409455.83703/event?isDownload=true&timeFormat=%FT%... Export&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000. Check the file name for capitalization or other typing errors. Check to see if the file was moved, renamed or deleted.
there are only 230 results so this is by no means a large csv that is being created to export.
It may be that Splunk is rerunning the search to complete the export. You could confirm this by seeing "your search will be rerun" at the bottom of the dialog box (just below "Number of Results).
If so, it may take longer then 30 seconds with is the default timeout value which will result in a "File not found" error when using FireFox (i.e. shows an HTTP 500 error).
One option would be to modify the splunkdConnectionTimeout parameter in your web.cof file.
I had the same issue - successful search, export failed with "File not found" message as above (Splunk 6.2.0).
After some research we found out that the issue was caused by a dynamic lookup script, that provided data to the search. The lookup returned data in utf-8 (not sure on that, might be some latin as well) encoding, which was not handled correctly by splunk. We fixed the issue by removing all specials characters (german umlauts) from the lookup result.
Maybe this helps.
Splunk 6.3.3 and seeing the same issue. Successful search and failed with "File not found". Search is
index = <ix> sourcetype = <st> | eval blah = upper(blah) | search [| inputlookup <lookup>.csv | eval blah=upper(blah) | fields blah ]
Get the following message.
Firefox can’t find the file at https://<splunkserver>.com/en-US/api/search/jobs/1474401463.33913_EFCB204A-D5CA-495C-9E83-AA90B82DEF....
Other searches export fine, other browsers also don't work. Any suggestions would be lovely.
The strangest part that I see that could be part of the issue is the distinct space in your URL between Test and Export. I suspect that this could be the reason why the file can't be found (spaces must be encoded in URL's/URI's.)
Spaces should be encoded as either "+" or "%20", but since Microsoft decided to blindly ignore the standard, everyone else has had to pretty much follow in their wake, and most browsers will forgive the abuse.
The break is from the name given to the file that's being exported so for example "Test Export" I did actually test that yesterday too, it didn't seem to make any difference if there were spaces or not.
So I ran the report again, waited for all the results to show and noted down the oldest result.
I then went ahead and ran the report again with specified dates so between the oldest date shown in the previous results up until today.
This time once the search had completed I was able to export without issue as expected, a work around of sorts I guess but why wouldnt it export the same data before ???