I had this exact error on this exact page, but it had nothing to do with setting SPLUNK_HOME. It was data related. A user had a private lookup that was pointing to a non-existent .swap file. Once I backed up and nuked the user's entire ./etc/users/[myuser]/SplunkEnterpriseSecuritySuite folder, and did a debug/refresh, the lookup definitions form rendered fine.
... View more