Security

Some users receive 404 when accessing custom apps

ftk
Motivator

Some of my users are unable to access a custom app we have developed internally. When they try to open the app, they receive the following error in their browser:

404 Not Found

App "app_name" does not support UI access. See its app.conf for more information.

In splunk's web_service.log, the following error is logged:

2010-08-17 08:40:27,250 WARNING [4c6a833a80494f208] view:472 - Splunk cannot load app "app_name" because it could not find a related app.conf file.

This app works for other users within the same splunk roles just fine. The app.conf looks to be configured correctly, and is in the appropriate location. The app is shared globally, with the role the user is a member of having read access.

What could be causing this issue, and how can I fix it?

1 Solution

hexx
Splunk Employee
Splunk Employee

There are a few places where you can check for role-based access lists specific to the app/ app views.

I would check first in $SPLUNK_HOME/etc/apps/app_name/metadata/default.meta and $SPLUNK_HOME/etc/apps/app_name/metadata/local.meta to review permissions there.

  • app-level permissions :

[] access = read : [ * ], write : [ admin, power ]

  • example of a viewstate-level permission :

[viewstates/flashtimeline%3Agalbtgqy]

access = read : [ admin, power ], write : [ admin ] export = none owner = admin

If all seems fine there and you still see splunkd inexplicably servicing 404s to one of your users, you may want to restart it and give it another go.

View solution in original post

hexx
Splunk Employee
Splunk Employee

There are a few places where you can check for role-based access lists specific to the app/ app views.

I would check first in $SPLUNK_HOME/etc/apps/app_name/metadata/default.meta and $SPLUNK_HOME/etc/apps/app_name/metadata/local.meta to review permissions there.

  • app-level permissions :

[] access = read : [ * ], write : [ admin, power ]

  • example of a viewstate-level permission :

[viewstates/flashtimeline%3Agalbtgqy]

access = read : [ admin, power ], write : [ admin ] export = none owner = admin

If all seems fine there and you still see splunkd inexplicably servicing 404s to one of your users, you may want to restart it and give it another go.

ftk
Motivator

A restart cleared the 404s -- there may have been some transient state.

0 Karma

rroberts
Splunk Employee
Splunk Employee

What is the default view for the app?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Is is possible that the specific user has an app.conf in their user directory that is overriding the global one?

ftk
Motivator

No app.conf anywhere in the user's directory.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...