All Apps and Add-ons

Why Lookup File Editor app logs an error when I edit a lookup file from another app with global permissions?

tedu
Engager

Hi,

I'm having a problem with the Lookup File Editor app. The app logs an error when I try to edit a lookup file:

name=javascript, class=Splunk.Error, lineNumber=873, messageTypeError: lookup_file_info is null, ...

The lookup file belongs to a different app on the search head but is set to read/write everyone and is global available. If I try to edit a system lookup file, then it works fine.

Any ideas?

Using Splunk 6.0.3 and Lookup File Editor 1.2

Thanks.

1 Solution

hcanivel8143
Engager

I have the very same issue, too, and I run v5.0.5. I tried updating to v5.0.9 to the same result.

Looking at Murphey's code as well as on the developer console, I extracted the URL's attempted. It seems to not be his code per se, but the backend: it's a bug with Splunk itself. The lookup editor simply fails to mask display error to the user (without viewing the console).

When you attempt to edit/view your lookup, it's running an ajax query. One of the parameters...the key parameter is owner. Remove from your query and you're golden. It's a hack, but it works around it. I myself am looking at removing that parameter from the query and it seems to work for me for now.

Example:
In lookup list view, I click on 'test.csv'. The URL I basically clicked on is:

https super-splunk:8000/en-US/app/myapp/lookup_edit?owner=me&path=myapp/authorized-scanners.csv

Change it to:
https super-splunk:8000/en-US/app/myapp/lookup_edit?path=myapp/authorized-scanners.csv

et voila!

Note: Luke, the two features/fixes requested are as follows:
1) If there are errors, shoot it to the page, as my page will fail and get stuck on the 'loading lookup file' splash and I'm left thinking it's still processing. Console says it had a bad request (then fails on a parameter check because there was no payload returned) which also is consistent with OP's error.

I tried uploading the snapshot, but apparently Splunk community sez I need moar karma to upload or attach links. Oh wells. Try this:
http picpaste.com/Screen_Shot_2014-08-22_at_9.30.25_AM-il16AGML.png

The user needs to know something's wrong. Smarter admins will be able to troubleshoot. Developer based ones (like myself, arguably) will be able to figure out precisely what to code/execute to fix.

2) Code fix: check for global permissions. Your query somewhere failed. If it's a backend Splunk issue, at least if the file is global, there's no need to specify within namespace. A slight hack, but working is better than not working.

Good luck!

View solution in original post

hcanivel8143
Engager

I have the very same issue, too, and I run v5.0.5. I tried updating to v5.0.9 to the same result.

Looking at Murphey's code as well as on the developer console, I extracted the URL's attempted. It seems to not be his code per se, but the backend: it's a bug with Splunk itself. The lookup editor simply fails to mask display error to the user (without viewing the console).

When you attempt to edit/view your lookup, it's running an ajax query. One of the parameters...the key parameter is owner. Remove from your query and you're golden. It's a hack, but it works around it. I myself am looking at removing that parameter from the query and it seems to work for me for now.

Example:
In lookup list view, I click on 'test.csv'. The URL I basically clicked on is:

https super-splunk:8000/en-US/app/myapp/lookup_edit?owner=me&path=myapp/authorized-scanners.csv

Change it to:
https super-splunk:8000/en-US/app/myapp/lookup_edit?path=myapp/authorized-scanners.csv

et voila!

Note: Luke, the two features/fixes requested are as follows:
1) If there are errors, shoot it to the page, as my page will fail and get stuck on the 'loading lookup file' splash and I'm left thinking it's still processing. Console says it had a bad request (then fails on a parameter check because there was no payload returned) which also is consistent with OP's error.

I tried uploading the snapshot, but apparently Splunk community sez I need moar karma to upload or attach links. Oh wells. Try this:
http picpaste.com/Screen_Shot_2014-08-22_at_9.30.25_AM-il16AGML.png

The user needs to know something's wrong. Smarter admins will be able to troubleshoot. Developer based ones (like myself, arguably) will be able to figure out precisely what to code/execute to fix.

2) Code fix: check for global permissions. Your query somewhere failed. If it's a backend Splunk issue, at least if the file is global, there's no need to specify within namespace. A slight hack, but working is better than not working.

Good luck!

tedu
Engager

@hcanivel8143 - thanks for the tip. I fixed the problem by removing the "owner = data.entry[c].author" parameter from line 79 in LookupFileLister.html

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...