Splunk Search

Lookup Errors When No Lookup Is Used

lodolivas
Engager

I'm getting "Could not find all of the specified lookup fields in the lookup table......." even when I'm not using a lookup. It references a particular lookup table that I do use in some searches but those searches complete just fine and the lookup returns values along with the error. The automatic lookup is configured for a particular sourcetype but I also get the error when searching other sourcetypes. I've tried remove the entire config for the lookup and the auto config and re-created it but the error persists. Any thoughts?

Tags (2)

Kenshiro70
Path Finder

I've had this too. From what I can tell, it's a permissions issue with Lookup definitions. Do not set Lookup definition permissions to Global. What happens is that in other apps the query looks for the definition within the app, even thought it's global. You can have the Lookup file at Global, but you have the create a Lookup definition within the app you want to use it and set the permission to App.

0 Karma

linu1988
Champion

It happens when the lookup definition is itself incorrect. Please check the lookup definition again.

0 Karma

dbourg_splunk
Splunk Employee
Splunk Employee

I've seen this before, and it usually occurs when there is a conflict with permissions, as well as what is in the configs themselves. Try deleting (or commenting out) anything in your props and transforms, then double check what may still exist via the GUI. Following that, you can re-enable your lookups and alter their permissions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...