We are using Splunk 6.2.4 build 271043 on Ubuntu and we are seeing a couple of pages in the Lookups section that are giving 500 internal errors.
When clicking on the Lookup Definitions link (see directly below):
![alt text][1]
We get the 500 internal server error shown directly below:
![alt text][2]
Note that in the example of the error, I am also showing Google Chrome developer tools to show the network information. I do not see any stack traces or clues in Google Chrome developer tools traffic (it's probably logging these locally to ensure security).
When I click on the "View more information about your request" link shown on the error page, it shows me a Splunk _internal search with no results. It seems strange to me that the error page is saying "at https://127.0.0.1:8089" rather than an external IP address. It leads me to believe that the server may be misconfigured. I am new to Splunk and have inherited the system, so any suggestions are welcome.
Additionally, the "Add new" link to the right of the "Automatic lookups" section also generates a 500 internal error. None of the non-Lookups pages on our Splunk web site give errors like these.
I have searched answers.splunk.com as well as Google searching but have not been able to find what the issue could be. Please feel free to refer me to any articles that could be helpful or any logs on the server that may shed some light on the issue. I do have admin access to the machine and can see any logs or .conf's that are relevant.
Thank you.
[1]: /storage/temp/125204-splunk-error1.png
[2]: /storage/temp/125205-splunk-error2.png
↧