Splunk Search

Splunk Indexer giving lookup missing error

sscandoit
Explorer

Hi All,

I have the following setup in my environment:
1) light forwarder installed on the machine where logs are generated
2) forwarder machine
3) Indexer which can perform search
4) Search head

I have created a view on search head and have saved the regular expressions in props.conf and transforms.conf files on this search head. I am also using a lookup in my view which is stored in $SPLUNK_HOME/etc/system/local/lookups.

When open the view, it displays the data correctly. However it shows message stating lookup file is missing on indexer machine.

I am not able to understand why indexer is also looking for the lookup. Could you please tell me how I can take care of this error? Once again thanks a lot for helping me. This forum has been really helpful to me.

Thanks
Suvelee

0 Karma

melting
Splunk Employee
Splunk Employee

Lookup search cmd will try to run on the indexers. You can force it to run only of the search head with local=true. Take a look at the docs for input search cmd

0 Karma

sscandoit
Explorer

Thanks for your reply. I will definitely try that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...