All Apps and Add-ons

Lookup File Editor in Search Head Cluster - "The requested lookup file does not exist"

mnm1987
Explorer

Hello Splunkers,
I Tried installing the latest version of the lookup_Editor app on our Search Head Cluster.
Accessing the lookup files in the editor gives me the following message "The requested lookup file does not exist".

But the same version works on my Standalone Dev Splunk Instance.

Are there any known issues w.r.t to the lookup_Editor app working on a Search Head Cluster ?

Regards,
Mukund M

mikelanghorst
Motivator

Having the same issues here, even after pulling the latest from GIT.

0 Karma

LukeMurphey
Champion

@mikelanghorst, @mnm1987: are you on Windows or Linux environments? It appears that the Windows Search Heads needed to be bounced (perhaps more than once) to get the controller to work.

0 Karma

mnm1987
Explorer

hey @LukeMurphey we are on Linux Environment, running Splunk 6.5.5 on both the Search Head and Indexer Clusters.
Thanks for the updates on the Question, We had to uninstall the App from our Production environment while we were triaging some other issues, I can definitely do a go ahead with re-installing the app and see if a rolling Restart on the Search Heads solves the issues.
Still trying to understand the cause if that turns out to be the reason for the linux environment too.

Regards
Mukund M

0 Karma

LukeMurphey
Champion

It could be that Windows is unrelated to the cause. Given that you are on Linux, that implies it might not be related.

I know that a bunch of customers run the app with SHC so I'm struggling a bit to figure out what the difference is in this case.

0 Karma

LukeMurphey
Champion

Did the previous version of the app work? I wasn't sure if this was only an issue after upgrade.

0 Karma

LukeMurphey
Champion

I'm going to create a cluster for testing to see if I can reproduce this. I know people use this app in SHC environments so I think it ought to work (or has in the past).

0 Karma

mikelanghorst
Motivator

I've only tried 2.7.1, then after seeing mention in github about a change for SHC I tried the git version as well. I'll try rolling back to a 2.6 when I have a few minutes for restarts.

0 Karma

mikelanghorst
Motivator

I'm not able to load any lookup files from any apps installed apps, nor create new.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...