Hello,
For some reason all of a sudden I keep seeing a page displaying the following error. I have not made any changes. I get the error when I click on the Manager or Administrator links at the top of every page in Splunk, and get the same when trying to access it from any app.
I can not find anywhere how to fix this, would really appreciate any help. Thanks
404 Not Found
Return to Splunk home page
Splunk cannot find the "_admin" view.
This page was linked to from http://localhost:81/en-US/app/launcher/home.
Similar issue documented here:
https://answers.splunk.com/answers/337286/after-removing-permission-dashboard-role-from-sear.html
Fix was = "In short... DO NOT DISABLE THE SEARCH AND REPORTING APPLICATION FOR ANYONE".
It was access problem at the backend on the path $SPLUNK_HOME/etc/default/data/ on our Search Head. The splunk user did not have execute permission.
On adding, you will be able to access the UI properly
What version of Splunk? Running on what platform? What account does Splunk run as (root, not root, admin, etc)?
Could you at some point have used a root account to start/stop/edit files in Splunk?