Splunk Apps » Lookup Editor

h1. Troubleshooting

h2. The app doesn't work following an upgrade.

See https://answers.splunk.com/answers/659194/how-do-i-clear-the-cache-to-see-the-changes-after-1.html

h2. The lookup files cannot be loaded or saved.

Look for applicable log messages with the following search:

<pre>

index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

</pre>

h2. I'm editing the lookup file but the results are not being saved

Check two things to see if there are any errors:

*Check for browser errors*

# Open the console in your browser. See the following pages for instructionsr: https://lucidchart.zendesk.com/hc/en-us/articles/207323676-How-to-Open-the-JavaScript-Console, https://webmasters.stackexchange.com/questions/8525/how-do-i-open-the-javascript-console-in-different-browsers

# Refresh the page and reproduce the issue

# Look for console logs that indicate an error

If someone is helping to troubleshoot the issue, you might want to generate a HAR file. See https://support.zendesk.com/hc/en-us/articles/204410413-Generating-a-HAR-file-for-troubleshooting for details.

*Check for error logs*

Run a search for the following and see if any errors exist:

<pre>

index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

</pre>

h2. One of the REST handlers is offline.

If you have recently updated or installed the Lookup Editor app, then you may need to restart the Search Heads again. The is particularly important if you are using SHC and the Deployer recently pushed the app to the Search Heads.

h2. I need more help, what information should I provide?

Please provide two things:

h3. HAR file

Reproduce the error in your browser and generate a HAR file per the following instructions: https://support.zendesk.com/hc/en-us/articles/204410413-Generating-a-HAR-file-for-troubleshooting

h3. Log files

Export the log files from the following search:

<pre>

index=_internal (sourcetype="lookup_editor_controller" OR sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler)

</pre>