Security

Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

rphillips_splk
Splunk Employee
Splunk Employee

Several UI links produce the 404 Not Found (Page not found!) when an app is invisible.

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search 

The problem is reproducable when an app is invisible and you try and:

  • edit an alert action of a scheduled search which lives in an invisible app "Click to edit actions"
  • click "run" from a saved search in an invisible app
  • "Click on saved search name from the "View recent" page" of a search that lives in an invisible app
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search 

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)

Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app

Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error

Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns

404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11

So, here replace the test_app_1 custom app name with search to make it look like:

http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11 

and load it on a different browser tab because you cannot modify the URI of the view recent page.

These issues are being tracked under internal Splunk bug: SPL-97879

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search 

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)

Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error

Workaround: The workaround is to set the request.ui_dispatch_app = search in the "savedsearches.conf" of the invisible app

Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error

Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns

404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11

So, here replace the test_app_1 custom app name with search to make it look like:

http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1465591320_11 

and load it on a different browser tab because you cannot modify the URI of the view recent page.

These issues are being tracked under internal Splunk bug: SPL-97879

reswob4
Builder

This is nice, but for automatic searches that output to a lookup table, it puts those tables into the Search & Reporting app instead of the hidden app.

Just started playing with it so I don't have a suggestion for a fix yet outside of manually moving the resulting lookup tables into the hidden app, which may involve manually deleting the current tables and replacing them with the new ones.....

EDIT: Looks like I spoke too soon. I just reviewed the results via sideview utils and the confirmed via ssh and those lookup table csv's are created in the hidden app.

apologies

0 Karma

kranzrm
Path Finder

Still seeing this problem in 6.5.3 but not for all saved searches. Click on Run for a saved search in a hidden app and get the 404.

0 Karma

woodcock
Esteemed Legend

Great research! You need to click "Accept".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...