Lookup Editor

[rajanshrivastav]

Hi,
I'm constantly getting following error in lookup editor app - "The lookup could not be loaded from the server"

I checked for permission on server, everything is ok, I checked with splunk support team, they told me that this is community supported app so they won't be able to help me on this.

I'm stuck on this for quite long time. Please help me in this case.

Thanks,

[quzen]

I had the same error, but for 1 particular CSV lookup file.

So, I suspected that there is an issue with the file's content.

Finally I found a special char NUL (\0) thanks to Notepad++ editor:

The problem was solved by removing that special char, deleting lookup and re-importing lookup.

[rajanshrivastav · Accepted solution]

This issue has been fixed by upgrading this to latest version.

Thank you all for helping me. 🙂

[richgalloway]

@rajanshrivastav786 If your problem is resolved, please accept the answer to help future readers.

[ddrillic]

Based on the identical case at owned lookupfiles can't be edited

It seems to be a permission issue.

[FeatureCreeep]

Make sure when you add a new csv, you actually add ".csv" to the end of the file name. It won't work right if you don't.

[valiquet]

I had the same issue because I renamed the app root folder. 😕

[rajanshrivastav]

@valiquet, can you please explain a little more, how you fixed this issue.

Thanks,

[valiquet]

After extracting the app from the archive, I renamed it and it was causing a bug. Did you rename the folder?

[rajanshrivastav]

No, I didn't renamed the App.

[p_gurav]

Hi,

Can you try this:
By going to etc/apps/the app that contains the lookup/metadata/local.meta

search for the csv file entry. should look something like this.

[lookups/lookup_table.csv]
version = ###
owner = nobody
modtime = 1464798467.783966000
access = read : [ * ], write : [ admin ]
export = system

and set the owner to nobody. You can restart the splunk process or issue the refresh command by going to http://splunk_server:8000/en-US/debug/refresh

[rajanshrivastav]

[root@splunk-prod2 metadata]# vim local.meta
[app/install/install_source_checksum]
version = 6.4.2
modtime = 1470899674.831067000

[]
access = read : [ * ], write : [ * ]
export = system
version = 6.5.3
modtime = 1518605602.193440000

[nav/default]
access = read : [ * ], write : [ admin, soc_edit_lookups ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116817.352097000

[views/lookup_edit]
access = read : [ * ], write : [ admin, soc_admin_role, soc_edit_lookups ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116785.563633000

[views/lookup_list]
access = read : [ * ], write : [ admin ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116794.498257000

[views/lookup_new]
access = read : [ * ], write : [ admin ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116803.294667000

[app/ui]
version = 6.5.3
modtime = 1519038393.200598000

and permission of local.meta is 777 for now.

Still getting the same issue

Error --
The lookup could not be loaded from the server
Right-click the table for editing options

[p_gurav]

Are you checking inside lookup editor app?

[rajanshrivastav]

Yes, inside the lookup editor app.

[rajanshrivastav]

I've set permission to 755 in /$SPLUNK_HOME/etc/app/