All Apps and Add-ons

Lookup editor 3.2.1 "The requested lookup file does not exist" worked fine in 2.7.1

Explorer

When clicking the app , the list of lookups is there and looks good. Clicking on Open in Search on the right works and shows the lookup fine.
Clicking on the lookup name on the left to view/edit it doesn't work and I get the "The requested lookup file does not exist" error.

I also get an error if I try to create a lookup in the editor: This lookup file could not be found.

This was not a problem in version 2.7.1.

Tags (1)

Champion

This is due to a Splunk defect which causes it to cache old code from the prior version of the app. In this case, the users' browser is attempting to execute code from version 2.7.1 of the Lookup Editor against Splunk which now has version 3 of the Lookup Editor.

See the following post for a workaround to the issue: https://answers.splunk.com/answers/659194/how-do-i-clear-the-cache-to-see-the-changes-after-1.html

Champion

This has been confirmed the issue that @cboillot was seeing.

Communicator

I did the 2nd one, the _bump, and that fixed it.

Thanks!

0 Karma

Communicator

I am getting the same error (below) after upgrading from 2.7.1 to the newest (as of today) 3.3.2. File I checked the file name, and it is correct, with the correct case

Request URL:
https://splunk-test.state.mo.us/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?looku...
Request Method: GET Status Code: 404
Not Found Remote Address:
10.241.43.132:443 Referrer Policy: no-referrer

HTTP/1.1 404 Not Found Date: Mon, 26
Aug 2019 21:37:34 GMT Content-Type:
text/html;charset=utf-8
X-Content-Type-Options: nosniff
Content-Length: 18891
Content-Encoding: gzip Vary:
Accept-Encoding, Cookie Connection:
Keep-Alive Set-Cookie:
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
expires=Tue, 27 Aug 2019 21:37:34 GMT;
httponly; Path=/; secure Server:
Splunkd

GET
/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?lookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995
HTTP/1.1 Host: splunk-test.state.mo.us
Connection: keep-alive Accept:
text/javascript, text/html,
application/xml, text/xml, /
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT
6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/76.0.3809.100 Safari/537.36
Sec-Fetch-Mode: cors Sec-Fetch-Site:
same-origin Accept-Encoding: gzip,
deflate, br Accept-Language:
en-US,en;q=0.9 Cookie:
mintjs%3Auuid=3ad36221-f102-43e6-83df-5c941551a581; built_by_tabuilder=yes;
ta_builder_current_ta_display_name=Test; ta_builder_current_ta_name=TA-test;
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
splunkweb_csrf_token_443=16964562962405069393;
token_key=16964562962405069393;
experience_id=06f15f9a-3e8e-f6d0-0514-ebaf81ddcb46; splunkd_443=u5uApPkEZ0sbos72sRUx3sxB2rLGc1LX_oULFJfa0cMoRdhhikGY0t1GjPG^bvrSXdRkf5DYVTxVQFaQ2vGk0EJQfNh9xHBaXRqHPm6M_K^sZk4TppDaYrnbtRyLHunf^3TRCo^9u4Q20wjX

lookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995

results of index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

2019-08-26 15:49:11,710 INFO Loading lookup file from path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Size of lookup file determined, file_size=408, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Resolved lookup file, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,663 INFO Retrieving lookup contents, namespace=chargeback, lookup=customers.csv, type=csv, owner=admin, version=None

I have an HAR file, where should I send it?

0 Karma

Champion

Send it to Luke at Lukemurphey.net. I'll take a look ASAP.

BTW: I'm the app author (ducks for cover).

0 Karma

Communicator

FYI, I went ahead and removed the app, and then reinstalled it. still getting the error.

0 Karma

Explorer

We also get this issue now. Our version is 3.3.1.
Please help for this issue. Thanks

Champion

Can you please help determine if there is some similarity between the lookups that will not load? I can likely fix this quickly once I figure out why they are not loading. Things to look for would be:

  1. Are the lookups in a particular app?
  2. Are the lookups owned by a particular user?
  3. Do the lookups have some characters in the name that might account for the error (e.g. "All lookups with a parenthesis in the name cannot be loaded")?
0 Karma

Explorer

Thanks for your response,below is my situation:
1.No,lookup file of all app can not been loaded
2.No,lookup file of any user also can not been loaded
3.Yes, All error message is the same. The message is "The requested lookup file does not exist".

And we try use different zone to load lookup file, like below.
source:
https://XXXX.com:8000/zh-TW/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
new link:
https://XXXX.com:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
And it work.

0 Karma

Path Finder

I saw this error too, I found the issue is due to a mismatch in case sensitive file systems.

the easy fix is to change the name of the file:
lookup_editor/appserver/static/js/utils/FormatTime.js to
lookup_editor/appserver/static/js/utils/formatTime.js

other option would be to edit these files:
lookup_editor/appserver/static/js/lib/HotEditors/DefaultEditor.js
lookup_editor/appserver/static/js/lib/HotEditors/TimeEditor.js
lookup_editor/appserver/static/js/views/TableEditorView.js

and change the line:
formatTime: '../app/lookup_editor/js/utils/formatTime',

To

formatTime: '../app/lookup_editor/js/utils/FormatTime',

0 Karma

Champion

This has been fixed in 3.3.1. See https://splunkbase.splunk.com/app/1724/

0 Karma

Splunk Employee
Splunk Employee

You might be able to get more info by opening the javascript console in your browser, but might want to start by restarting the search head.

If all else fails, see the below instructions on how to create a HAR file, and reach out to the developer.
https://lukemurphey.net/projects/splunk-lookup-editor/wiki/Troubleshooting

0 Karma

Champion

Is there any error in _internal index?

0 Karma

Explorer

I see these:
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
A few of these:
-0400 WARN HttpListener - Socket error from 10.10.10.111 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown

0 Karma

Champion

Did you recently do the upgrade? I'm wondering if some of the old Javascript is being cached.

0 Karma

Explorer

Yes. I tried incognito mode and in a different browser, same results.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!