Security
Highlighted

Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

Splunk Employee
Splunk Employee

Several UI links produce the 404 Not Found (Page not found!) when an app is invisible.

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search 

The problem is reproducable when an app is invisible and you try and:

  • edit an alert action of a scheduled search which lives in an invisible app "Click to edit actions"
  • click "run" from a saved search in an invisible app
  • "Click on saved search name from the "View recent" page" of a search that lives in an invisible app
Highlighted

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

Splunk Employee
Splunk Employee

Invisible App 404 errors:
Problem:
navigate to Settings >> Searches, Reports and Alerts
choose a search that lives in an invisible app and click search name to edit.
Alert actions:"Click to edit actions" link
you will get the following error:

404 Not Found

Return to Splunk home page

Page not found!

View more information about your request (request ID = 575f2a248b7f18c442be90) in Search 

Workaround: The workaround is to set the request.uidispatchapp = search in the "savedsearches.conf" of the invisible app ($SPLUNK_HOME/etc/apps/yourinvisibleapp/local/savedsearches.conf)

Problem: Click "Run" link from the Searches, reports, and alerts page of a search that lives in an invisible app and get the 404 Not Found error

Workaround: The workaround is to set the request.uidispatchapp = search in the "savedsearches.conf" of the invisible app

Problem: Click on saved search name from the "View recent" page" of a search that lives in an invisible app and get the 404 Not Found error

Workaround: A manual workaround would be to replace the app name with "search" and load the page. Basically, for e.g. when you click on a saved search from view recent page, you will get this URI which returns

404: http://127.0.0.1:8000/en-US/app/test_app_1/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_...

So, here replace the test_app_1 custom app name with search to make it look like:

http://127.0.0.1:8000/ui/en-US/app/search/search?sid=scheduler__admin_dGVzdF9hcHBfMQ__mysearch1_at_1... 

and load it on a different browser tab because you cannot modify the URI of the view recent page.

These issues are being tracked under internal Splunk bug: SPL-97879

View solution in original post

Highlighted

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

Esteemed Legend

Great research! You need to click "Accept".

0 Karma
Highlighted

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

Builder

This is nice, but for automatic searches that output to a lookup table, it puts those tables into the Search & Reporting app instead of the hidden app.

Just started playing with it so I don't have a suggestion for a fix yet outside of manually moving the resulting lookup tables into the hidden app, which may involve manually deleting the current tables and replacing them with the new ones.....

EDIT: Looks like I spoke too soon. I just reviewed the results via sideview utils and the confirmed via ssh and those lookup table csv's are created in the hidden app.

apologies

0 Karma
Highlighted

Re: Why am I getting a "404 Not Found Page not found!" error when an app is invisible?

Path Finder

Still seeing this problem in 6.5.3 but not for all saved searches. Click on Run for a saved search in a hidden app and get the 404.

0 Karma