Splunk Apps » Lookup Editor

1. Affects 2.7.0 and 2.7.1
2. Doesn't seem to affect standalone
3. Didn't repro for me
4. It appears that controller isn't registered (seeing "Masking the original 404 message: 'The path '/en-US/custom/lookup_editor/lookup_edit/get_lookup_backups_list' was not found.' with 'Page not found!'")
5. The files appear to exist on the search heads
6. Appeared on a 6.5.1 instance

1. Does this appear on a fresh 6.5.1 when I repro it?
2. When was the controller last modified?
3. Did second customer have any errors?
4. Can the controller be parsed and loaded manually?

Here is the controller's history:
https://github.com/LukeMurphey/lookup-editor/commits/19870b2c81a2df8f419d96bb3f0416f6b0da681a/src/appserver/controllers/lookup_edit.py
Last changed in May.

Here is the history for the web.conf file:
https://github.com/LukeMurphey/lookup-editor/commits/master/src/default/web.conf
Even fewer changes.

The controller file can be checked to see if it parses with:

cd etc/apps/lookup_editor/appserver/controllers/
../../../../../bin/splunk cmd python lookup_edit.py

The following indicates if the controller is registered (look for "/custom/lookup_editor/lookup_edit"):

http://10.0.1.14:8000/en-US/paths

The following provides the web.conf entries:

| rest /servicesNS/nobody/lookup_editor/admin/conf-web count=0 | table id title eai:appName | search title="*lookup_edit" 

This indicates that the controller was registered:

Registering custom app endpoint: lookup_editor/lookup_edit

It could be that another app is using the same stanza name in web.conf.

Customer 2:

• This is on Windows
• Controller is not registered according to the logs
• There are no errors in the logs

• Is lookup file loading?
  • Yes
• Is the controller responding with a 404 or is the lookup controller itself not found?
  • Controller is not registered

This is what I'm seeing:

1. Controller is on disk
2. Splunk sees the corresponding web.conf
3. There are no errors indicating that Splunk failed to run the controller
4. There are no messages indicating Splunk even tried to run the controller

Customer bounced the cluster and it fixed the issue

I might want to add something that tests to make sure that the controllers/endpoints are up. That way, the user can be told something isn't right.