topic Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist" in All Apps and Add-ons

Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mnm1987 — Tue, 12 Sep 2017 18:16:52 GMT

Hello Splunkers,
I Tried installing the latest version of the lookup_Editor app on our Search Head Cluster.
Accessing the lookup files in the editor gives me the following message "The requested lookup file does not exist".

But the same version works on my Standalone Dev Splunk Instance.

Are there any known issues w.r.t to the lookup_Editor app working on a Search Head Cluster ?

Regards,
Mukund M

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Fri, 13 Oct 2017 23:12:19 GMT

Having the same issues here, even after pulling the latest from GIT.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Fri, 13 Oct 2017 23:15:20 GMT

Did the previous version of the app work? I wasn't sure if this was only an issue after upgrade.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Fri, 13 Oct 2017 23:18:30 GMT

I'm going to create a cluster for testing to see if I can reproduce this. I know people use this app in SHC environments so I think it ought to work (or has in the past).

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Sat, 14 Oct 2017 07:14:12 GMT

I tried to reproduce this with 2.7.1 but I was able to create and save a lookup.

BTW: I wouldn't recommend trying the one from GIT yet. That version is still in development and isn't release quality yet.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mwdbhyat — Mon, 16 Oct 2017 12:15:25 GMT

Have you checked the permissions on the lookup files in question?

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Mon, 16 Oct 2017 15:45:53 GMT

I've only tried 2.7.1, then after seeing mention in github about a change for SHC I tried the git version as well. I'll try rolling back to a 2.6 when I have a few minutes for restarts.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Mon, 16 Oct 2017 15:46:47 GMT

I'm not able to load any lookup files from any apps installed apps, nor create new.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Mon, 16 Oct 2017 15:48:03 GMT

Running Splunk as root, and logged in as Admin. No lookup files can be viewed/opened in the app.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Tue, 29 Sep 2020 16:15:49 GMT

Also of note, in your troubleshooting suggestion:
index=_internal sourcetype="lookup_editor_controller"

Returns no results.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Tue, 17 Oct 2017 18:55:10 GMT

Thats a good find. It sounds like the controller couldn't start.

Could you run a search for the following and let me know if it shows anything of value (especially if any of the messages indicate an error)?

index=_internal lookup_edit sourcetype=splunk_web_service

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Tue, 29 Sep 2020 16:16:29 GMT

Ah, that gives something:

2017-10-16 11:22:00,555 INFO [59e4f8c88b7f1ae85b9d90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Tue, 17 Oct 2017 21:23:59 GMT

Do you also see an error that indicates why the controller couldn't load? It should somewhere around the time that Splunk started.

It may appear with this search:

index=_internal lookup_edit sourcetype=splunk_web_service ERROR

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Tue, 17 Oct 2017 21:24:54 GMT

BTW: sorry for the extensive debugging questions. I tried several times to reproduce this in various environments (various Splunk versions, SHC and standalone, etc) but couldn't get it to reproduce for me.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Tue, 17 Oct 2017 21:42:55 GMT

just more page not found messages:

2017-10-12 11:59:01,664 INFO    [59dfbb75a77fadc4208750] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,935 INFO    [59dfa78aec7f695c31cbd0] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:34:02,717 INFO    [59dfa78ab57f695c31ce90] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:37,443 INFO    [59dfa6456e7f695c57aa10] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:28:33,226 INFO    [59dfa641357f695c57aa50] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/save' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,380 INFO    [59dfa5e75f7f695c637710] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
2017-10-12 10:27:03,315 INFO    [59dfa5e74e7f698052f550] error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Tue, 29 Sep 2020 16:19:53 GMT

Could you verify that the following two files exist on one of the affected search heads?

$SPLUNK_HOME/etc/apps/lookup_editor/appserver/controllers/lookup_edit.py
$SPLUNK_HOME/etc/apps/lookup_editor/default/web.conf

If those exist, then make sure that web.conf includes the following:

[endpoint:lookup_edit]

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mikelanghorst — Tue, 17 Oct 2017 22:03:16 GMT

Both exist, and web.conf has that content on all 3 of my SHC nodes.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

kcepull_splunk — Thu, 19 Oct 2017 15:15:30 GMT

I'm getting the same errors. SHC 6.5.1, LFE 2.71. Fresh install of the app into an existing SHC.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

LukeMurphey — Thu, 19 Oct 2017 20:12:11 GMT

@kcepull: could you try version 2.7.0?

I have deployed this on an SHC environment and cannot get a repro on this. I'm wondering if this is limited to 2.7.1.

Re: Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

kcepull_splunk — Thu, 19 Oct 2017 20:55:59 GMT

We tried 2.7.0, and got the same results (error).