Some users receive 404 when accessing custom apps

[ftk]

Some of my users are unable to access a custom app we have developed internally. When they try to open the app, they receive the following error in their browser:

404 Not Found

App "app_name" does not support UI access. See its app.conf for more information.

In splunk's web_service.log, the following error is logged:

2010-08-17 08:40:27,250 WARNING [4c6a833a80494f208] view:472 - Splunk cannot load app "app_name" because it could not find a related app.conf file.

This app works for other users within the same splunk roles just fine. The app.conf looks to be configured correctly, and is in the appropriate location. The app is shared globally, with the role the user is a member of having read access.

What could be causing this issue, and how can I fix it?

[hexx · Accepted solution]

There are a few places where you can check for role-based access lists specific to the app/ app views.

I would check first in $SPLUNK_HOME/etc/apps/app_name/metadata/default.meta and $SPLUNK_HOME/etc/apps/app_name/metadata/local.meta to review permissions there.

• app-level permissions :

[] access = read : [ * ], write : [ admin, power ]

• example of a viewstate-level permission :

[viewstates/flashtimeline%3Agalbtgqy]

access = read : [ admin, power ], write : [ admin ] export = none owner = admin

If all seems fine there and you still see splunkd inexplicably servicing 404s to one of your users, you may want to restart it and give it another go.

[ftk]

A restart cleared the 404s -- there may have been some transient state.

[rroberts]

What is the default view for the app?

[gkanapathy]

Is is possible that the specific user has an app.conf in their user directory that is overriding the global one?

[ftk]

No app.conf anywhere in the user's directory.