Splunk® App for Lookup File Editing

User Guide

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Troubleshoot the Splunk App for Lookup File Editing

Here are some common tasks and issues when using the Splunk App for Lookup File Editing and how to resolve them.

Data imported into a CSV lookup file is not separating into columns as expected

Your CSV file may have values that are being misidentified as cell delimiters. For example, if you are using commas to separate your field values, but some field values include semicolons, the importer may be interpreting those semicolons as additional delimiters.

Ensure your CSV file is only using one of the following delimiters and that the CSV does not include other delimiters as field values: comma (","), semicolon (";"), tabspace ("\t"), pipe ("|"), or carrot ("^").

The app is no longer working after an upgrade

This is likely caused by a caching issue. See, How do I clear the cache to see the changes after updating a Splunk application? in Splunk Answers.

The lookup files cannot be opened, loaded, or saved

Look for applicable log messages with the following search:

index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

The lookup file edits are not being saved

Check two things to see if there are any errors - browser errors, and error logs.

Check for browser errors

  1. Open the console in your browser. See the following pages for instructions: https://lucidchart.zendesk.com/hc/en-us/articles/207323676-How-to-Open-the-JavaScript-Console, https://webmasters.stackexchange.com/questions/8525/how-do-i-open-the-javascript-console-in-different-browsers
  2. Refresh the page and reproduce the issue.
  3. Look for console logs that indicate an error.

If support is helping to troubleshoot the issue, you can generate and provide them with a HAR file. See https://support.zendesk.com/hc/en-us/articles/204410413-Generating-a-HAR-file-for-troubleshooting for details.

Check for error logs

Run the following search and see if any errors exist:

index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

One of the REST handlers is offline

If you have recently updated or installed the Lookup Editor app, then you may need to restart the Search Heads again. The is particularly important if you are using SHC and the Deployer recently pushed the app to the Search Heads.

How can I audit changes to the lookup file?

The lookup editor keeps a log that is indexed into the _internal index. Run the following command to view the logs:

index=_internal "Lookup edited successfully" | table _time user namespace lookup_file

How do I set up the app on a search head cluster?

Perform the following steps to setup the app on a search head cluster:

  1. Install the Splunk App for Lookup File Editing on the search head cluster.
  2. SSH on the cluster manager.
  3. Go to $SPLUNK_HOME/etc/shcluster/apps/lookup_editor/default/restmap.conf
  4. Enable replication of the lookup backups by using the REST replay feature. Add the following to restmap.conf:
    [global]
    allowRestReplay = true
  5. Execute the following command to push the search head cluster bundle. In this example, the value of SH-uri is https://<fqdn-of-any-sh>:8089:
    splunk apply shcluster-bundle -target <SH-uri> -preserve-lookups true

How do I run the app on a search head cluster?

There are several things to consider when running the app on a search head cluster:

  • Backup lookup files will not replicate unless you specifically enable it.
  • CSV and KV store lookups will be replicated automatically by default.
  • Make sure that the app has properly been distributed to all of the search heads before troubleshooting issues with the app.
  • Make sure your web-browsers are not caching older versions of the app.

How do I enable replicating off the lookup file backups to other search heads when using a search head cluster?

You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf to the $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf file:

[global]
allowRestReplay = true

This will work on Splunk Enterprise version 6.3 and higher, and on Splunk Enterprise version 7.1 and higher. Do not enable this on Splunk Enterprise versions 7.0.0 to 7.0.3 due to a bug that causes REST replay to crash splunkd.

Contacting support

If you require further assistance from support, provide the following information with your support request:

  1. HAR file: Reproduce the error in your browser and generate a HAR file per the following instructions: https://support.zendesk.com/hc/en-us/articles/204410413-Generating-a-HAR-file-for-troubleshooting
  2. Log files:Export the log files using the following search:

    index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

Last modified on 20 May, 2022
PREVIOUS
Edit a Lookup File
  NEXT
What's new in the Splunk App for Lookup File Editing

This documentation applies to the following versions of Splunk® App for Lookup File Editing: 3.6.0


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters