Getting Data In

Unable to Export to CSV with error "File not found"

AaronMoorcroft
Communicator

Hi Guys

Can anyone advise on this? I'm running a search in 6.2.4, but no matter what browser, Firefox, Chrome or IE, when exporting to CSV, I get the below error:

File not found

Firefox can't find the file at https://servername:8000/en-US/api/search/jobs/1442409455.83703/event?isDownload=true&timeFormat=%FT%... Export&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000.

    Check the file name for capitalization or other typing errors.
    Check to see if the file was moved, renamed or deleted.

there are only 230 results so this is by no means a large csv that is being created to export.

Tags (2)

sparrowe
Explorer

It may be that Splunk is rerunning the search to complete the export. You could confirm this by seeing "your search will be rerun" at the bottom of the dialog box (just below "Number of Results).

If so, it may take longer then 30 seconds with is the default timeout value which will result in a "File not found" error when using FireFox (i.e. shows an HTTP 500 error).

One option would be to modify the splunkdConnectionTimeout parameter in your web.cof file.

bleinfelder
Path Finder

Hi there,

I had the same issue - successful search, export failed with "File not found" message as above (Splunk 6.2.0).

After some research we found out that the issue was caused by a dynamic lookup script, that provided data to the search. The lookup returned data in utf-8 (not sure on that, might be some latin as well) encoding, which was not handled correctly by splunk. We fixed the issue by removing all specials characters (german umlauts) from the lookup result.

Maybe this helps.

Bernd

0 Karma

proletariat99
Communicator

Splunk 6.3.3 and seeing the same issue. Successful search and failed with "File not found". Search is

index = <ix> sourcetype = <st> | eval blah = upper(blah) | search [| inputlookup <lookup>.csv | eval blah=upper(blah) | fields blah ]

Get the following message.

Firefox can’t find the file at https://<splunkserver>.com/en-US/api/search/jobs/1474401463.33913_EFCB204A-D5CA-495C-9E83-AA90B82DEF....

Other searches export fine, other browsers also don't work. Any suggestions would be lovely.

0 Karma

AaronMoorcroft
Communicator

Thanks for the additional info, i've not seen this happen again yet, nor has it been reported to me again however if it is, ill investigate again with the above in mind,

Thanks

0 Karma

grijhwani
Motivator

Have you got some ridiculously short job retention time set, or any full disk partitions on the search head?

0 Karma

tlelle_splunk
Splunk Employee
Splunk Employee

The strangest part that I see that could be part of the issue is the distinct space in your URL between Test and Export. I suspect that this could be the reason why the file can't be found (spaces must be encoded in URL's/URI's.)

0 Karma

grijhwani
Motivator

Spaces should be encoded as either "+" or "%20", but since Microsoft decided to blindly ignore the standard, everyone else has had to pretty much follow in their wake, and most browsers will forgive the abuse.

0 Karma

AaronMoorcroft
Communicator

The break is from the name given to the file that's being exported so for example "Test Export" I did actually test that yesterday too, it didn't seem to make any difference if there were spaces or not.

0 Karma

tlelle_splunk
Splunk Employee
Splunk Employee

When I try to download a csv in the same manner that you did, and I include a space, the space is turned into an underscore ( _ ).

0 Karma

AaronMoorcroft
Communicator

Hey

So I ran the report again, waited for all the results to show and noted down the oldest result.

I then went ahead and ran the report again with specified dates so between the oldest date shown in the previous results up until today.

This time once the search had completed I was able to export without issue as expected, a work around of sorts I guess but why wouldnt it export the same data before ???

0 Karma

somesoni2
Revered Legend

Just to be sure, you freshly ran the search and tried to export, not that job is expired or something?

0 Karma

AaronMoorcroft
Communicator

Nope I have ran it on a seperate search head as well as the indexer, logged off and back on and tried the different browsers, its very very odd

0 Karma

jclehmuth
Path Finder

Are you using the export button or outputing to a Lookup table?

0 Karma

AaronMoorcroft
Communicator

im using the little downwards arrow icon to export

0 Karma

jclehmuth
Path Finder

Sounds like it might be a permission issue (either Splunk or computer), have you exported anything before.

0 Karma

AaronMoorcroft
Communicator

yeah other searches seem to work ok, just seems to be an issue with this one so far ??? source="/var/adm/syslog/syslog.log" host=SERVERNAME "abort"

0 Karma

jclehmuth
Path Finder

Sorry, not sure what to tell you then, maybe there is a glitch in the matrx

0 Karma

AaronMoorcroft
Communicator

no worries, thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!