topic Why is there a bug in Splunk App for Lookup File Editing not using root_endpoint? in All Apps and Add-ons

Why is there a bug in Splunk App for Lookup File Editing not using root_endpoint?

rain — Tue, 01 Aug 2023 18:30:15 GMT

Splunk App for Lookup File Editing version 3.6.0 works fine, but version 4.0.1 does not use root_endpoint.

Downgrade to 3.6.0 and it works fine.

settings:

splunk:
conf:
- key: web
value:
directory: /opt/splunk/etc/system/local
content:
settings:
root_endpoint: /splunk

Expected results: https://server/splunk/ko-KR/app/lookup_editor/lookup_edit......

v4.0.1 : https://server/app/lookup_editor/lookup_edit......

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

burwell — Sun, 23 Jul 2023 21:35:58 GMT

Hi. Can you file a case with splunk support about this?

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

burwell — Tue, 01 Aug 2023 02:41:56 GMT

Hi @rain I did a quick experiment as follows and did not have an issue with the lookup editor. 4.0 The path was correct as expected (/splunk was added).

/opt/splunk/etc/system/local/web.conf root_endpoint = /splunk

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

rain — Tue, 01 Aug 2023 03:37:37 GMT

Since I'm using a free license, I can't seem to open a case.

The root_endpoint in the /opt/splunk/etc/system/local/web.conf file is set correctly, and Splunk is working fine.

I'm sorry, I didn't write it down clearly enough.

If you use Lookup editor v4.0.1,
https://splunk_address/splunk/ko-KR/app/lookup_editor/lookup_list
page, the links are looking incorrectly like this
https://splunk_address/app/lookup_editor/lookup_edit?...

They should look like this
https://splunk_address/splunk/ko-KR/app/lookup_editor/lookup_edit?...

In Lookup editor v3.6.0 and earlier, it looks fine using the root_endpoint value.

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

burwell — Tue, 01 Aug 2023 17:15:13 GMT

Hi. I am not seeing this issue. Here's the output from btool to show the root_endpoint is splunk

/opt/splunk/bin/splunk btool web list --debug | grep root /opt/splunk/etc/system/local/web.conf root_endpoint = /splunk

If I click on the lookup editor I see this URL

https://server:port/splunk/en-US/app/lookup_editor/lookup_list

So /splunk is there in the URL and the lookup editor works.

Debugging ideas

1) run btool to make sure you have the endpoint setup as expected
2) possibly look in your logs for errors

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

rain — Wed, 02 Aug 2023 00:43:22 GMT

For testing, I did a clean install of Splunk enterprise v9.0.5 as a docker image, and got the same results.

After the initial installation, I logged in with admin // password and installed the splunk-app-for-lookup-file-editing_401.tgz

- btool results

sudo /opt/splunk/bin/splunk btool web list --debug | grep root
/opt/splunk/etc/system/local/web.conf root_endpoint = /splunk

- screenshot of test instance

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

burwell — Wed, 02 Aug 2023 05:47:25 GMT

hi @rain Thanks for the very thorough testing and screenshot.

So I looked at my test instance and actually I do see what you are seeing when you hover over a lookup: the root endpoint "/splunk" is not there BUT when I click on the csv in the lookup editor, I am able to edit the lookup.

Did you try to edit a lookup? I don't get an error at all and things do seem to work.

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

rain — Wed, 02 Aug 2023 07:40:03 GMT

Only URLs starting with /splunk are delivered to Splunk through reverse-proxy, so it does not work in my environment.

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

burwell — Sun, 06 Aug 2023 20:32:10 GMT

This appears to be a bug in Lookup Editor 4.0.1: It is not honoring the locale OR the root_endpoint

I will file a bug about this.

Re: Bug in Splunk App for Lookup File Editing not using root_endpoint

rain — Mon, 07 Aug 2023 04:42:26 GMT

For the test, /app/lookup_editor URL was also set to reverse-proxy toward splunk, but it did not work properly, so currently downgraded to v3.6.0.
If I connect directly to the splunk using a port without reverse-proxy, it works normally as you said.
Thank you.