Splunk Search

Why am I getting "500 Internal Server Error" when I go to Settings > Lookups > Lookup Definitions?

adamsmith47
Communicator

I was attempting to add a lookup definition in a custom app, but, after visiting the page successfully a few times, now I just get an error. I have restarted splunk.

So, now when I navigate to Settings > Lookups > Lookup definitions, then choose my custom app in the App context dropdown menu, I get the error:

500 Internal Server Error

Return to Splunk home page

View more information about your
request (request ID =
586d6a09c7aec57f0) in Search

This page was linked to from
https://splunk/en-US/manager/search/data/transforms/lookups.

I get no errors when I navigate to Settings > Lookups > Lookup table files, or Settings > Lookups > Automatic lookups, then select my custom app from the dropdown.

Any advice is greatly appreciated.

Thank you!

Tags (3)
0 Karma

dbot2001
Path Finder

Found a way to spot the troublesome csv.  (worked for me, anyway)  requires CLI.

The grep looks for special characters in the file.

find $SPLUNK_HOME/etc  -name "transforms.conf" | xargs grep -l -P -n "[\x80-\xFF]"

find $SPLUNK_HOME/etc  -name "*.csv" | xargs grep -l -P -n "[\x80-\xFF]"

 

Another thing that helped track down the issue was run the rest call as a Splunk search, then look at the search.log

| rest /services/data/transforms/lookups
0 Karma

pkarpushin
Path Finder

I faced the same problem.
The file-based lookup has been defined in transforms.conf, splunk service was restarted, dashboards with this lookup in my-app work fine, but whenever I try to open http://:/en-US/manager//data/transforms/lookups I get 500 Internal Server Error.
The reason was in the csv file. One of the field names had mixed name with latin and cyrillic symbols.

0 Karma

jdumont33
Explorer

I had the same problem.
Solved it by removing all the lookups and adding them back 1 by 1 until I found the file that was causing it.
Apparently a user tried to use a CSV file containing ";" instide of "," to separate the fields.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi adamsmith47,
What happens If you try to open your lookup using Lookup Editor App?
Every way, try to delete your lookup file and insert it again.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...