Splunk App for Lookup File Editing - REST Handler offline

[DaClyde]

Since upgrading to the new 4.0.4 release of the Lookup File Editor, the app no longer shows any lookups in the main interface.  The Status page says the REST handler is offline, and while the troubleshooting page references that, it provides no recommendations aside from restarting Splunk.

Well, we have restarted everything at least 3 times, but still cannot access our lookups.  What does a REST handler being offline even mean?  Is that a setting?  Can the Search Head just not see the REST interface?  We couldn't find any settings or conf files within the editor app that define a particular address.  The app resides on the search head, along with the lookups, so I can't imagine it is a firewall issue.

This is the only error we are seeing in the internal logs:

09/16/2024 09:50:24 AM -0500 CDT ERROR Failed to handle request due to an unhandled exception Traceback (most recent call last):
  File "D:\Splunk\etc\apps\lookup_editor\bin\lookup_editor\rest_handler.py", line 196, in handle
    return function_to_call(request_info, **query)
  File "D:\Splunk\etc\apps\lookup_editor\bin\lookup_editor_rest_handler.py", line 688, in post_file_size        
    lookup_author = res["entry"][i]["author"]
KeyError: 'author'

Help?

[Meett · Accepted solution]

You can try to re-install app it will resolve this issue.

[DaClyde]

No luck.   The Health and Status dashboards work, so it does see the lookups, we just can't access them in the main screen.  We're currently on Splunk 9.2.2, so maybe it will clear up once we move to 9.3.

[DaClyde]

We ended up with some corruption after a server migration that required a restore from backup.  Now the Lookup Editor is working again.