Why is there a bug in Splunk App for Lookup File Editing not using root_endpoint?

[rain]

Splunk App for Lookup File Editing version 3.6.0 works fine, but version 4.0.1 does not use root_endpoint.

Downgrade to 3.6.0 and it works fine.

settings:

splunk:
  conf:
    - key: web
      value:
        directory: /opt/splunk/etc/system/local
        content:
          settings:
          root_endpoint: /splunk

Expected results:  https://server/splunk/ko-KR/app/lookup_editor/lookup_edit......

v4.0.1 : https://server/app/lookup_editor/lookup_edit......

[burwell]

Hi @rain  I did a quick experiment as follows and did not have an issue with the lookup editor. 4.0 The path was correct as expected (/splunk was added).

/opt/splunk/etc/system/local/web.conf                              root_endpoint = /splunk

[rain]

Since I'm using a free license, I can't seem to open a case.

The root_endpoint in the /opt/splunk/etc/system/local/web.conf file is set correctly, and Splunk is working fine.

I'm sorry, I didn't write it down clearly enough.

If you use Lookup editor v4.0.1,
https://splunk_address/splunk/ko-KR/app/lookup_editor/lookup_list
page, the links are looking incorrectly like this
https://splunk_address/app/lookup_editor/lookup_edit?...

They should look like this
https://splunk_address/splunk/ko-KR/app/lookup_editor/lookup_edit?...

In Lookup editor v3.6.0 and earlier, it looks fine using the root_endpoint value.

[burwell]

Hi. I am not seeing this issue. Here's the output from btool to show the root_endpoint is splunk

/opt/splunk/bin/splunk btool web list --debug | grep root
/opt/splunk/etc/system/local/web.conf                              root_endpoint = /splunk

If I click on the lookup editor I see this URL

https://server:port/splunk/en-US/app/lookup_editor/lookup_list

So /splunk is there in the URL and the lookup editor works.

Debugging ideas

1) run btool to make sure you have the endpoint setup as expected
2) possibly look in your logs for errors

[rain]

For testing, I did a clean install of Splunk enterprise v9.0.5 as a docker image, and got the same results.

After the initial installation, I logged in with admin // password and installed the splunk-app-for-lookup-file-editing_401.tgz

- btool results

sudo /opt/splunk/bin/splunk btool web list --debug | grep root
/opt/splunk/etc/system/local/web.conf root_endpoint = /splunk

- screenshot of test instance

[burwell]

hi @rain Thanks for the very thorough testing and screenshot.

So I looked at my test instance and actually I do see what you are seeing when you hover over a lookup: the root endpoint "/splunk" is not there BUT when I click on the csv in the lookup editor, I am able to edit the lookup. 

Did you try to edit a lookup? I don't get an error at all and things do seem to work.

[rain]

Only URLs starting with /splunk are delivered to Splunk through reverse-proxy, so it does not work in my environment.

[burwell · Accepted solution]

This appears to be a bug in Lookup Editor 4.0.1: It is not honoring the locale OR the root_endpoint

I will file a bug about this.

[rain]

For the test, /app/lookup_editor URL was also set to reverse-proxy toward splunk, but it did not work properly, so currently downgraded to v3.6.0.
If I connect directly to the splunk using a port without reverse-proxy, it works normally as you said.
Thank you.

[burwell]

Hi. Can you file a case with splunk support about this?