All Apps and Add-ons

Lookup Editor

Path Finder

Hi,
I'm constantly getting following error in lookup editor app - "The lookup could not be loaded from the server"

I checked for permission on server, everything is ok, I checked with splunk support team, they told me that this is community supported app so they won't be able to help me on this.

I'm stuck on this for quite long time. Please help me in this case.

Thanks,

Tags (1)
0 Karma
1 Solution

Path Finder

This issue has been fixed by upgrading this to latest version.

Thank you all for helping me. 🙂

View solution in original post

0 Karma

Path Finder

This issue has been fixed by upgrading this to latest version.

Thank you all for helping me. 🙂

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@rajanshrivastav786 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Ultra Champion

Based on the identical case at owned lookupfiles can't be edited

It seems to be a permission issue.

0 Karma

Path Finder

Make sure when you add a new csv, you actually add ".csv" to the end of the file name. It won't work right if you don't.

0 Karma

Contributor

I had the same issue because I renamed the app root folder. 😕

0 Karma

Path Finder

@valiquet, can you please explain a little more, how you fixed this issue.

Thanks,

0 Karma

Contributor

After extracting the app from the archive, I renamed it and it was causing a bug. Did you rename the folder?

0 Karma

Path Finder

No, I didn't renamed the App.

0 Karma

Champion

Hi,

Can you try this:
By going to etc/apps/the app that contains the lookup/metadata/local.meta

search for the csv file entry. should look something like this.

[lookups/lookup_table.csv]
version = ###
owner = nobody
modtime = 1464798467.783966000
access = read : [ * ], write : [ admin ]
export = system

and set the owner to nobody. You can restart the splunk process or issue the refresh command by going to http://splunk_server:8000/en-US/debug/refresh

0 Karma

Path Finder

[root@splunk-prod2 metadata]# vim local.meta
[app/install/install_source_checksum]
version = 6.4.2
modtime = 1470899674.831067000

[]
access = read : [ * ], write : [ * ]
export = system
version = 6.5.3
modtime = 1518605602.193440000

[nav/default]
access = read : [ * ], write : [ admin, soc_edit_lookups ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116817.352097000

[views/lookup_edit]
access = read : [ * ], write : [ admin, soc_admin_role, soc_edit_lookups ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116785.563633000

[views/lookup_list]
access = read : [ * ], write : [ admin ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116794.498257000

[views/lookup_new]
access = read : [ * ], write : [ admin ]
export = system
owner = nobody
version = 6.5.3
modtime = 1520116803.294667000

[app/ui]
version = 6.5.3
modtime = 1519038393.200598000

and permission of local.meta is 777 for now.

Still getting the same issue

Error --
The lookup could not be loaded from the server
Right-click the table for editing options

0 Karma

Champion

Are you checking inside lookup editor app?

0 Karma

Path Finder

Yes, inside the lookup editor app.

0 Karma

Path Finder

I've set permission to 755 in /$SPLUNK_HOME/etc/app/

0 Karma