Why am I getting "500 Internal Server Error" when I go to Settings > Lookups > Lookup Definitions?

[adamsmith47]

I was attempting to add a lookup definition in a custom app, but, after visiting the page successfully a few times, now I just get an error. I have restarted splunk.

So, now when I navigate to Settings > Lookups > Lookup definitions, then choose my custom app in the App context dropdown menu, I get the error:

500 Internal Server Error

Return to Splunk home page

View more information about your
request (request ID =
586d6a09c7aec57f0) in Search

This page was linked to from
https://splunk/en-US/manager/search/data/transforms/lookups.

I get no errors when I navigate to Settings > Lookups > Lookup table files, or Settings > Lookups > Automatic lookups, then select my custom app from the dropdown.

Any advice is greatly appreciated.

Thank you!

[dbot2001]

Found a way to spot the troublesome csv.  (worked for me, anyway)  requires CLI.

The grep looks for special characters in the file.

find $SPLUNK_HOME/etc  -name "transforms.conf" | xargs grep -l -P -n "[\x80-\xFF]"

find $SPLUNK_HOME/etc  -name "*.csv" | xargs grep -l -P -n "[\x80-\xFF]"

Another thing that helped track down the issue was run the rest call as a Splunk search, then look at the search.log

| rest /services/data/transforms/lookups

[pkarpushin]

I faced the same problem.
The file-based lookup has been defined in transforms.conf, splunk service was restarted, dashboards with this lookup in my-app work fine, but whenever I try to open http://:/en-US/manager//data/transforms/lookups I get 500 Internal Server Error.
The reason was in the csv file. One of the field names had mixed name with latin and cyrillic symbols.

[jdumont33]

I had the same problem.
Solved it by removing all the lookups and adding them back 1 by 1 until I found the file that was causing it.
Apparently a user tried to use a CSV file containing ";" instide of "," to separate the fields.

[gcusello]

Hi adamsmith47,
What happens If you try to open your lookup using Lookup Editor App?
Every way, try to delete your lookup file and insert it again.
Bye.
Giuseppe