I was attempting to add a lookup definition in a custom app, but, after visiting the page successfully a few times, now I just get an error. I have restarted splunk.
So, now when I navigate to Settings > Lookups > Lookup definitions, then choose my custom app in the App context dropdown menu, I get the error:
500 Internal Server Error
Return to Splunk home page
View more information about your
request (request ID =
586d6a09c7aec57f0) in SearchThis page was linked to from
https://splunk/en-US/manager/search/data/transforms/lookups.
I get no errors when I navigate to Settings > Lookups > Lookup table files, or Settings > Lookups > Automatic lookups, then select my custom app from the dropdown.
Any advice is greatly appreciated.
Thank you!
Found a way to spot the troublesome csv. (worked for me, anyway) requires CLI.
The grep looks for special characters in the file.
find $SPLUNK_HOME/etc -name "transforms.conf" | xargs grep -l -P -n "[\x80-\xFF]"
find $SPLUNK_HOME/etc -name "*.csv" | xargs grep -l -P -n "[\x80-\xFF]"
Another thing that helped track down the issue was run the rest call as a Splunk search, then look at the search.log
| rest /services/data/transforms/lookups
I faced the same problem.
The file-based lookup has been defined in transforms.conf, splunk service was restarted, dashboards with this lookup in my-app work fine, but whenever I try to open http://:/en-US/manager//data/transforms/lookups I get 500 Internal Server Error.
The reason was in the csv file. One of the field names had mixed name with latin and cyrillic symbols.
I had the same problem.
Solved it by removing all the lookups and adding them back 1 by 1 until I found the file that was causing it.
Apparently a user tried to use a CSV file containing ";" instide of "," to separate the fields.
Hi adamsmith47,
What happens If you try to open your lookup using Lookup Editor App?
Every way, try to delete your lookup file and insert it again.
Bye.
Giuseppe