Splunk Search

Saved searches issue with SSO

lrhazi
Path Finder

With all saved searches, I get this error when I try to run them:

The saved search "%2FservicesNS%2Fnobody%2Fsearch%2Fsaved%2Fsearches%2FErrors%2520in%2520the%2520last%252024%2520hours" could not be found.

am using Splunk 5.0

Also, when I first create a search, the popup wizard give this error:

500 Internal Server Error

Return to Splunk home page

ResourceNotFound: [HTTP 404] https://127.0.0.1:8089/services/%2FservicesNS%2Fml623%2Fsearch%2Fsaved%2Fsearches%2Ftest03; []

The search is effectivily created, as I can see iet later on in the drop down and in Saved Searches....

am thinking these two issues are related...
I must be missing some setting that helps the GUI know it is now running behind a proxy.
But which setting is it?

0 Karma
1 Solution

lrhazi
Path Finder

Support tells me this a bug related to SSL:

SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.

View solution in original post

0 Karma

lrhazi
Path Finder

Support tells me this a bug related to SSL:

SPL-57518 has been assigned to this
issue. It happens because there is
wrong uri encoding from splunkweb when
using SSL.

0 Karma

lrhazi
Path Finder

To be clear, I did some configuration, and it is exactly the document you linked. I am sure I missed something though, but what is it?

0 Karma

lrhazi
Path Finder

No, I did not. That document says to only add anything if the proxy is hosting splunk on non root uri:

If you host Splunk Web behind a proxy that does not place Splunk Web at the proxy's root, you may also need to configure the root_endpoint setting in $SPLUNK_HOME/etc/system/local/web.conf.

What should I put in web.conf exactly, regarding the URIs?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

So, you did no configuration to tell Splunk that you are behind an SSO proxy.

0 Karma

lrhazi
Path Finder

Not sure what you mean by "what configuration you did perform". My proxy is what I believe to be a typical apache proxy config, performing ldap auth and forwarding traffic to localhost:8000 where splunk web is running by default.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

It may be easier to advise you if you indicated what configuration you did perform, and how exactly you and your proxy access Splunk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...