When clicking the app , the list of lookups is there and looks good. Clicking on Open in Search on the right works and shows the lookup fine.
Clicking on the lookup name on the left to view/edit it doesn't work and I get the "The requested lookup file does not exist" error.
I also get an error if I try to create a lookup in the editor: This lookup file could not be found.
This was not a problem in version 2.7.1.
This is due to a Splunk defect which causes it to cache old code from the prior version of the app. In this case, the users' browser is attempting to execute code from version 2.7.1 of the Lookup Editor against Splunk which now has version 3 of the Lookup Editor.
See the following post for a workaround to the issue: https://answers.splunk.com/answers/659194/how-do-i-clear-the-cache-to-see-the-changes-after-1.html
This has been confirmed the issue that @cboillot was seeing.
I did the 2nd one, the _bump, and that fixed it.
Thanks!
I am getting the same error (below) after upgrading from 2.7.1 to the newest (as of today) 3.3.2. File I checked the file name, and it is correct, with the correct case
Request URL:
https://splunk-test.state.mo.us/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?looku...
Request Method: GET Status Code: 404
Not Found Remote Address:
10.241.43.132:443 Referrer Policy: no-referrerHTTP/1.1 404 Not Found Date: Mon, 26
Aug 2019 21:37:34 GMT Content-Type:
text/html;charset=utf-8
X-Content-Type-Options: nosniff
Content-Length: 18891
Content-Encoding: gzip Vary:
Accept-Encoding, Cookie Connection:
Keep-Alive Set-Cookie:
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
expires=Tue, 27 Aug 2019 21:37:34 GMT;
httponly; Path=/; secure Server:
SplunkdGET
/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?lookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995
HTTP/1.1 Host: splunk-test.state.mo.us
Connection: keep-alive Accept:
text/javascript, text/html,
application/xml, text/xml, /
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT
6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/76.0.3809.100 Safari/537.36
Sec-Fetch-Mode: cors Sec-Fetch-Site:
same-origin Accept-Encoding: gzip,
deflate, br Accept-Language:
en-US,en;q=0.9 Cookie:
mintjs%3Auuid=3ad36221-f102-43e6-83df-5c941551a581; built_by_tabuilder=yes;
ta_builder_current_ta_display_name=Test; ta_builder_current_ta_name=TA-test;
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
splunkweb_csrf_token_443=16964562962405069393;
token_key=16964562962405069393;
experience_id=06f15f9a-3e8e-f6d0-0514-ebaf81ddcb46; splunkd_443=u5uApPkEZ0sbos72sRUx3sxB2rLGc1LX_oULFJfa0cMoRdhhikGY0t1GjPG^bvrSXdRkf5DYVTxVQFaQ2vGk0EJQfNh9xHBaXRqHPm6M_K^sZk4TppDaYrnbtRyLHunf^3TRCo^9u4Q20wjXlookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995
results of index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)
2019-08-26 15:49:11,710 INFO Loading lookup file from path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Size of lookup file determined, file_size=408, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Resolved lookup file, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,663 INFO Retrieving lookup contents, namespace=chargeback, lookup=customers.csv, type=csv, owner=admin, version=None
I have an HAR file, where should I send it?
Send it to Luke at Lukemurphey.net. I'll take a look ASAP.
BTW: I'm the app author (ducks for cover).
FYI, I went ahead and removed the app, and then reinstalled it. still getting the error.
We also get this issue now. Our version is 3.3.1.
Please help for this issue. Thanks
Can you please help determine if there is some similarity between the lookups that will not load? I can likely fix this quickly once I figure out why they are not loading. Things to look for would be:
Thanks for your response,below is my situation:
1.No,lookup file of all app can not been loaded
2.No,lookup file of any user also can not been loaded
3.Yes, All error message is the same. The message is "The requested lookup file does not exist".
And we try use different zone to load lookup file, like below.
source:
https://XXXX.com:8000/zh-TW/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
new link:
https://XXXX.com:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
And it work.
I saw this error too, I found the issue is due to a mismatch in case sensitive file systems.
the easy fix is to change the name of the file:
lookup_editor/appserver/static/js/utils/FormatTime.js to
lookup_editor/appserver/static/js/utils/formatTime.js
other option would be to edit these files:
lookup_editor/appserver/static/js/lib/HotEditors/DefaultEditor.js
lookup_editor/appserver/static/js/lib/HotEditors/TimeEditor.js
lookup_editor/appserver/static/js/views/TableEditorView.js
and change the line:
formatTime: '../app/lookup_editor/js/utils/formatTime',
To
formatTime: '../app/lookup_editor/js/utils/FormatTime',
This has been fixed in 3.3.1. See https://splunkbase.splunk.com/app/1724/
You might be able to get more info by opening the javascript console in your browser, but might want to start by restarting the search head.
If all else fails, see the below instructions on how to create a HAR file, and reach out to the developer.
https://lukemurphey.net/projects/splunk-lookup-editor/wiki/Troubleshooting
Is there any error in _internal index?
I see these:
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
A few of these:
-0400 WARN HttpListener - Socket error from 10.10.10.111 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown
Did you recently do the upgrade? I'm wondering if some of the old Javascript is being cached.
Yes. I tried incognito mode and in a different browser, same results.