Splunk Search

Saved searches issue with SSO

lrhazi
Path Finder

With all saved searches, I get this error when I try to run them:

The saved search "%2FservicesNS%2Fnobody%2Fsearch%2Fsaved%2Fsearches%2FErrors%2520in%2520the%2520last%252024%2520hours" could not be found.

am using Splunk 5.0

Also, when I first create a search, the popup wizard give this error:

500 Internal Server Error

Return to Splunk home page

ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03; []

The search is effectivily created, as I can see iet later on in the drop down and in Saved Searches....

am thinking these two issues are related...
I must be missing some setting that helps the GUI know it is now running behind a proxy.
But which setting is it?

0 Karma
1 Solution

lrhazi
Path Finder

Support tells me this a bug related to SSL:

SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.

View solution in original post

0 Karma

lrhazi
Path Finder

Support tells me this a bug related to SSL:

SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.

View solution in original post

0 Karma

lrhazi
Path Finder

To be clear, I did some configuration, and it is exactly the document you linked. I am sure I missed something though, but what is it?

0 Karma

lrhazi
Path Finder

No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:

If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.

What should I put in web.conf exactly, regarding the URIs?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

So, you did no configuration to tell Splunk that you are behind an SSO proxy.

0 Karma

lrhazi
Path Finder

Not sure what you mean by "what configuration you did perform". My proxy is what I believe to be a typical apache proxy config, performing ldap auth and forwarding traffic to localhost:8000 where splunk web is running by default.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It may be easier to advise you if you indicated what configuration you did perform, and how exactly you and your proxy access Splunk.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!