400 Bad Request error when attempting to export a app via ACS API

Available Languages

Updated:October 1, 2026
Document ID:SPLK052898

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud 10.0.2503

Description

Following a recent upgrade of the Splunk Cloud stack to version 10.0.2503.7, attempts to export apps using the curl command return the following error: 

HTTP/2 400

Investigation

1.Confirm if the stack was recently upgraded to version 10.0.2503.7  

 

2. The error occurs specifically during app export operations via ACS , Run the following curl command to test the functionality:

curl -v -X GET \
"https://admin.splunk.com/<stackname>/adminconfig/v2/apps/victoria/export/download/<app>" \
-H "Authorization: Bearer TOKEN"

This command returns an error: HTTP/2 400 

 

Note: Other curl commands for different ACS features work as expected.


Resolution

This is a known issue in Splunk Cloud version 10.0.2503.7 and the issue has been resolved in future release versions.


To restore the app export functionality, upgrade the stack to a higher version 10.1.X.X where the fix has been implemented.
After the upgrade, the ACS app export feature should work as expected.

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products