With all saved searches, I get this error when I try to run them:
The saved search "%2FservicesNS%2Fnobody%2Fsearch%2Fsaved%2Fsearches%2FErrors%2520in%2520the%2520last%252024%2520hours" could not be found.
am using Splunk 5.0
Also, when I first create a search, the popup wizard give this error:
500 Internal Server Error
Return to Splunk home page
ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03; []
The search is effectivily created, as I can see iet later on in the drop down and in Saved Searches....
am thinking these two issues are related...
I must be missing some setting that helps the GUI know it is now running behind a proxy.
But which setting is it?
Support tells me this a bug related to SSL:
SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.
Support tells me this a bug related to SSL:
SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.
To be clear, I did some configuration, and it is exactly the document you linked. I am sure I missed something though, but what is it?
No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:
If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.
What should I put in web.conf exactly, regarding the URIs?
So, you did no configuration to tell Splunk that you are behind an SSO proxy.
Not sure what you mean by "what configuration you did perform". My proxy is what I believe to be a typical apache proxy config, performing ldap auth and forwarding traffic to localhost:8000 where splunk web is running by default.
It may be easier to advise you if you indicated what configuration you did perform, and how exactly you and your proxy access Splunk.