Unable to Export to CSV with error "File not found"

[AaronMoorcroft]

Hi Guys

Can anyone advise on this? I'm running a search in 6.2.4, but no matter what browser, Firefox, Chrome or IE, when exporting to CSV, I get the below error:

File not found

Firefox can't find the file at https://servername:8000/en-US/api/search/jobs/1442409455.83703/event?isDownload=true&timeFormat=%FT%... Export&outputMode=csv&spl_ctrl-limit=unlimited&spl_ctrl-count=1000.

    Check the file name for capitalization or other typing errors.
    Check to see if the file was moved, renamed or deleted.

there are only 230 results so this is by no means a large csv that is being created to export.

[sparrowe]

It may be that Splunk is rerunning the search to complete the export. You could confirm this by seeing "your search will be rerun" at the bottom of the dialog box (just below "Number of Results).

If so, it may take longer then 30 seconds with is the default timeout value which will result in a "File not found" error when using FireFox (i.e. shows an HTTP 500 error).

One option would be to modify the splunkdConnectionTimeout parameter in your web.cof file.

[bleinfelder]

Hi there,

I had the same issue - successful search, export failed with "File not found" message as above (Splunk 6.2.0).

After some research we found out that the issue was caused by a dynamic lookup script, that provided data to the search. The lookup returned data in utf-8 (not sure on that, might be some latin as well) encoding, which was not handled correctly by splunk. We fixed the issue by removing all specials characters (german umlauts) from the lookup result.

Maybe this helps.

Bernd

[proletariat99]

Splunk 6.3.3 and seeing the same issue. Successful search and failed with "File not found". Search is

index = <ix> sourcetype = <st> | eval blah = upper(blah) | search [| inputlookup <lookup>.csv | eval blah=upper(blah) | fields blah ]

Get the following message.

Firefox can’t find the file at https://<splunkserver>.com/en-US/api/search/jobs/1474401463.33913_EFCB204A-D5CA-495C-9E83-AA90B82DEF....

Other searches export fine, other browsers also don't work. Any suggestions would be lovely.

[AaronMoorcroft]

Thanks for the additional info, i've not seen this happen again yet, nor has it been reported to me again however if it is, ill investigate again with the above in mind,

Thanks

[grijhwani]

Have you got some ridiculously short job retention time set, or any full disk partitions on the search head?

[tlelle_splunk]

The strangest part that I see that could be part of the issue is the distinct space in your URL between Test and Export. I suspect that this could be the reason why the file can't be found (spaces must be encoded in URL's/URI's.)

[grijhwani]

Spaces should be encoded as either "+" or "%20", but since Microsoft decided to blindly ignore the standard, everyone else has had to pretty much follow in their wake, and most browsers will forgive the abuse.

[AaronMoorcroft]

The break is from the name given to the file that's being exported so for example "Test Export" I did actually test that yesterday too, it didn't seem to make any difference if there were spaces or not.

[tlelle_splunk]

When I try to download a csv in the same manner that you did, and I include a space, the space is turned into an underscore ( _ ).

[AaronMoorcroft]

Hey

So I ran the report again, waited for all the results to show and noted down the oldest result.

I then went ahead and ran the report again with specified dates so between the oldest date shown in the previous results up until today.

This time once the search had completed I was able to export without issue as expected, a work around of sorts I guess but why wouldnt it export the same data before ???

[somesoni2]

Just to be sure, you freshly ran the search and tried to export, not that job is expired or something?

[AaronMoorcroft]

Nope I have ran it on a seperate search head as well as the indexer, logged off and back on and tried the different browsers, its very very odd

[jclehmuth]

Are you using the export button or outputing to a Lookup table?

[AaronMoorcroft]

im using the little downwards arrow icon to export

[jclehmuth]

Sounds like it might be a permission issue (either Splunk or computer), have you exported anything before.

[AaronMoorcroft]

yeah other searches seem to work ok, just seems to be an issue with this one so far ??? source="/var/adm/syslog/syslog.log" host=SERVERNAME "abort"

[jclehmuth]

Sorry, not sure what to tell you then, maybe there is a glitch in the matrx

[AaronMoorcroft]

no worries, thanks