Several UI links produce the 404 Not Found (Page not found!) when an app is invisible.
404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 575f2a248b7f18c442be90) in Search
The problem is reproducable when an app is invisible and you try and:
Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:
404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 575f2a248b7f18c442be90) in Search
Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)
Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error
Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app
Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error
Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns
404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11
So, here replace the test_app_1
custom app name with search
to make it look like:
http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11
and load it on a different browser tab because you cannot modify the URI of the view recent page.
These issues are being tracked under internal Splunk bug: SPL-97879
Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:
404 Not Found
Return to Splunk home page
Page not found!
View more information about your request (request ID = 575f2a248b7f18c442be90) in Search
Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)
Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error
Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app
Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error
Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns
404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11
So, here replace the test_app_1
custom app name with search
to make it look like:
http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11
and load it on a different browser tab because you cannot modify the URI of the view recent page.
These issues are being tracked under internal Splunk bug: SPL-97879
This is nice, but for automatic searches that output to a lookup table, it puts those tables into the Search & Reporting app instead of the hidden app.
Just started playing with it so I don't have a suggestion for a fix yet outside of manually moving the resulting lookup tables into the hidden app, which may involve manually deleting the current tables and replacing them with the new ones.....
EDIT: Looks like I spoke too soon. I just reviewed the results via sideview utils and the confirmed via ssh and those lookup table csv's are created in the hidden app.
apologies
Still seeing this problem in 6.5.3 but not for all saved searches. Click on Run for a saved search in a hidden app and get the 404.
Great research! You need to click "Accept".