Alerting

URLs in alerts are correct but being routed to the wrong app and returns 404

neiljpeterson
Communicator

Generated links in alerts are being routed to an old name of an app even though the path is correct.

The name change was just a change in case (eg MyApp to myapp) because it was causing an issue with savedsearches.conf

Now when an alert goes out the link is (spaces added to escape auto-formatting)

https:// splunk.domain. net/app/myapp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

HOWEVER the browser is actually routed to

https://splunk.domain.net/app/MyApp/@go?sid=rt_scheduler_bmVpbC5wZXRlcnNvbg__myapp__RMD5ec95cf321e8ea7ff_at_1401458542_0.246

I reinstalled the app, restarted the server and did a /debug/refresh the links still are not working correctly.

What are my next steps?

Tags (2)
0 Karma
1 Solution

neiljpeterson
Communicator

So I found the issue here.

There was a duplicate stanza in $SPLUNK_HOME\etc\users\my.user\myapp\local\savedsearches.conf that had the old app name for request.ui_dispatch_app

This stanza was trumping the stanza in app directory.

I think this happened because I manually copied the savedsearch to the app directory but forgot to remove it from my user\app\local directory.

A great lesson in conf file order of precedence.

View solution in original post

0 Karma

neiljpeterson
Communicator

So I found the issue here.

There was a duplicate stanza in $SPLUNK_HOME\etc\users\my.user\myapp\local\savedsearches.conf that had the old app name for request.ui_dispatch_app

This stanza was trumping the stanza in app directory.

I think this happened because I manually copied the savedsearch to the app directory but forgot to remove it from my user\app\local directory.

A great lesson in conf file order of precedence.

0 Karma

MuS
SplunkTrust
SplunkTrust

nice done 🙂

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi neiljipeterson,

did you check app.conf in your app directory does that match the new name, also check if the directory in $SPLUNK_HOME/etc/apps/ matches the new name.

I just did a test renaming my test app mySandBox to myfooBOX by changing the label in app.conf but not changing the directory in $SPLUNK_HOME/etc/apps/. So now my app is labeled myfooBOX in Splunk but the URL is still pointing to http://mysplunkserver/en-US/app/mySandBox/search ...

hope this helps ...

cheers, MuS

0 Karma

neiljpeterson
Communicator

No, the app label still has the capital letters. I would like to leave it that way. But just for testing I did change it and it does not seem to have an effect on the URL, nor would I expect it to. Most apps have different labels than their physical paths, right?

Yes, the physical path is correct and has the new name.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...