All Apps and Add-ons

Lookup editor 3.2.1 "The requested lookup file does not exist" worked fine in 2.7.1

corerosoc
Explorer

When clicking the app , the list of lookups is there and looks good. Clicking on Open in Search on the right works and shows the lookup fine.
Clicking on the lookup name on the left to view/edit it doesn't work and I get the "The requested lookup file does not exist" error.

I also get an error if I try to create a lookup in the editor: This lookup file could not be found.

This was not a problem in version 2.7.1.

Tags (1)

LukeMurphey
Champion

This is due to a Splunk defect which causes it to cache old code from the prior version of the app. In this case, the users' browser is attempting to execute code from version 2.7.1 of the Lookup Editor against Splunk which now has version 3 of the Lookup Editor.

See the following post for a workaround to the issue: https://answers.splunk.com/answers/659194/how-do-i-clear-the-cache-to-see-the-changes-after-1.html

LukeMurphey
Champion

This has been confirmed the issue that @cboillot was seeing.

cboillot
Contributor

I did the 2nd one, the _bump, and that fixed it.

Thanks!

0 Karma

cboillot
Contributor

I am getting the same error (below) after upgrading from 2.7.1 to the newest (as of today) 3.3.2. File I checked the file name, and it is correct, with the correct case

Request URL:
https://splunk-test.state.mo.us/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?looku...
Request Method: GET Status Code: 404
Not Found Remote Address:
10.241.43.132:443 Referrer Policy: no-referrer

HTTP/1.1 404 Not Found Date: Mon, 26
Aug 2019 21:37:34 GMT Content-Type:
text/html;charset=utf-8
X-Content-Type-Options: nosniff
Content-Length: 18891
Content-Encoding: gzip Vary:
Accept-Encoding, Cookie Connection:
Keep-Alive Set-Cookie:
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
expires=Tue, 27 Aug 2019 21:37:34 GMT;
httponly; Path=/; secure Server:
Splunkd

GET
/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list?lookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995
HTTP/1.1 Host: splunk-test.state.mo.us
Connection: keep-alive Accept:
text/javascript, text/html,
application/xml, text/xml, /
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT
6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/76.0.3809.100 Safari/537.36
Sec-Fetch-Mode: cors Sec-Fetch-Site:
same-origin Accept-Encoding: gzip,
deflate, br Accept-Language:
en-US,en;q=0.9 Cookie:
mintjs%3Auuid=3ad36221-f102-43e6-83df-5c941551a581; built_by_tabuilder=yes;
ta_builder_current_ta_display_name=Test; ta_builder_current_ta_name=TA-test;
session_id_443=149f35522becc979063bcded225082aed80c6d4b;
splunkweb_csrf_token_443=16964562962405069393;
token_key=16964562962405069393;
experience_id=06f15f9a-3e8e-f6d0-0514-ebaf81ddcb46; splunkd_443=u5uApPkEZ0sbos72sRUx3sxB2rLGc1LX_oULFJfa0cMoRdhhikGY0t1GjPG^bvrSXdRkf5DYVTxVQFaQ2vGk0EJQfNh9xHBaXRqHPm6M_K^sZk4TppDaYrnbtRyLHunf^3TRCo^9u4Q20wjX

lookup_file=customers.csv&namespace=chargeback&owner=nobody&_=1566855451995

results of index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

2019-08-26 15:49:11,710 INFO Loading lookup file from path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Size of lookup file determined, file_size=408, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,710 INFO Resolved lookup file, path=D:\Splunk\etc\apps\chargeback\lookups\customers.csv
2019-08-26 15:49:11,663 INFO Retrieving lookup contents, namespace=chargeback, lookup=customers.csv, type=csv, owner=admin, version=None

I have an HAR file, where should I send it?

0 Karma

LukeMurphey
Champion

Send it to Luke at Lukemurphey.net. I'll take a look ASAP.

BTW: I'm the app author (ducks for cover).

0 Karma

cboillot
Contributor

FYI, I went ahead and removed the app, and then reinstalled it. still getting the error.

0 Karma

bj6192
Explorer

We also get this issue now. Our version is 3.3.1.
Please help for this issue. Thanks

LukeMurphey
Champion

Can you please help determine if there is some similarity between the lookups that will not load? I can likely fix this quickly once I figure out why they are not loading. Things to look for would be:

  1. Are the lookups in a particular app?
  2. Are the lookups owned by a particular user?
  3. Do the lookups have some characters in the name that might account for the error (e.g. "All lookups with a parenthesis in the name cannot be loaded")?
0 Karma

bj6192
Explorer

Thanks for your response,below is my situation:
1.No,lookup file of all app can not been loaded
2.No,lookup file of any user also can not been loaded
3.Yes, All error message is the same. The message is "The requested lookup file does not exist".

And we try use different zone to load lookup file, like below.
source:
https://XXXX.com:8000/zh-TW/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
new link:
https://XXXX.com:8000/en-US/app/lookup_editor/lookup_edit?owner=nobody&namespace=P1&lookup=ABC.csv&t...
And it work.

0 Karma

mhessel
Path Finder

I saw this error too, I found the issue is due to a mismatch in case sensitive file systems.

the easy fix is to change the name of the file:
lookup_editor/appserver/static/js/utils/FormatTime.js to
lookup_editor/appserver/static/js/utils/formatTime.js

other option would be to edit these files:
lookup_editor/appserver/static/js/lib/HotEditors/DefaultEditor.js
lookup_editor/appserver/static/js/lib/HotEditors/TimeEditor.js
lookup_editor/appserver/static/js/views/TableEditorView.js

and change the line:
formatTime: '../app/lookup_editor/js/utils/formatTime',

To

formatTime: '../app/lookup_editor/js/utils/FormatTime',

0 Karma

LukeMurphey
Champion

This has been fixed in 3.3.1. See https://splunkbase.splunk.com/app/1724/

0 Karma

nvanderwalt_spl
Splunk Employee
Splunk Employee

You might be able to get more info by opening the javascript console in your browser, but might want to start by restarting the search head.

If all else fails, see the below instructions on how to create a HAR file, and reach out to the developer.
https://lukemurphey.net/projects/splunk-lookup-editor/wiki/Troubleshooting

0 Karma

p_gurav
Champion

Is there any error in _internal index?

0 Karma

corerosoc
Explorer

I see these:
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_contents' was not found.' with 'Page not found!' for security reasons
error:133 - Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!' for security reasons
A few of these:
-0400 WARN HttpListener - Socket error from 10.10.10.111 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown

0 Karma

LukeMurphey
Champion

Did you recently do the upgrade? I'm wondering if some of the old Javascript is being cached.

0 Karma

corerosoc
Explorer

Yes. I tried incognito mode and in a different browser, same results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...