What is the root cause of Splunk lookup error "'Could not find all of the specified destination fields in the lookup table.'"?

[deepak02]

Hi,

I have a setup with 4 Search heads, 6 indexers and many forwarders.

I keep seeing the below error in splunkd.log (of the search head alone),

02-23-2017 08:51:10.138 -0500 ERROR LookupOperator - Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'host::*' and lookup table 'SampleLookupDefinition'

This error occurs in the search head alone. I am able to run Splunk searches and retrieve data successfully.
Please help me fix it.

UPDATE: This error got fixed when I deleted and recreated the automatic lookup. But I want to find the root cause.
Thanks,
Deepak

[DalJeanis]

Basically, somewhere there was a lookup defined that had erroneous or misspelled fields in it.

Say your lookup table KeyFoo is defined like this

Key1 Key2 Foo1 Foo2 Bar

And let's say that something like one of these searches is defined

| lookup KeyFoo Key1 OUTPUT Foo3
| lookup KeyFoo Key2 FOo2 OUTPUT FOo1
| lookup KeyFoo Key1 Foo2 OUTPUT FOo1 Bar

The system is saying that you're trying to match up with / output something that isn't actually on the table.

[deepak02]

Thankyou.

I deleted and recreated the automatic lookup with the exact same config, and it works now.

Could it be a system/software problem?