Splunk Search

What is the root cause of Splunk lookup error "'Could not find all of the specified destination fields in the lookup table.'"?

deepak02
Path Finder

Hi,

I have a setup with 4 Search heads, 6 indexers and many forwarders.

I keep seeing the below error in splunkd.log (of the search head alone),

02-23-2017 08:51:10.138 -0500 ERROR LookupOperator - Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'host::*' and lookup table 'SampleLookupDefinition'

This error occurs in the search head alone. I am able to run Splunk searches and retrieve data successfully.
Please help me fix it.

UPDATE: This error got fixed when I deleted and recreated the automatic lookup. But I want to find the root cause.
Thanks,
Deepak

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Basically, somewhere there was a lookup defined that had erroneous or misspelled fields in it.

Say your lookup table KeyFoo is defined like this

Key1 Key2 Foo1 Foo2 Bar

And let's say that something like one of these searches is defined

| lookup KeyFoo Key1 OUTPUT Foo3
| lookup KeyFoo Key2 FOo2 OUTPUT FOo1
| lookup KeyFoo Key1 Foo2 OUTPUT FOo1 Bar

The system is saying that you're trying to match up with / output something that isn't actually on the table.

0 Karma

deepak02
Path Finder

Thankyou.

I deleted and recreated the automatic lookup with the exact same config, and it works now.

Could it be a system/software problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...