Getting error message - "Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' and lookup table 'customers'."

[Arpit_S]

Hi,

We are getting below error message in our instance,

[idxXX.sharefile.splunkcloud.com] Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' and lookup table 'customers'.

This csv customers belongs to Chargeback app, as there was an update for the app available, the app was updated . Since then we are getting these errors.

There is another instance where we have this app installed and was updated as well. But we aren't getting any error messages in that instance.

The fields in the two lookups are exactly the same. The only difference is on one instance the permission for the lookup is set to "Global" {the one on which we are getting errors} and on the other it is set to "App".

Version of instance with errors – 6.5.1
Version of instance without errors – 6.5.1612

Please let us know how can this issue be resolved.

Thanks,
Arpit

[nickhills]

It sounds like you have a column missing from one of the files.

Try running:

|inputlookup <name of lookup> 

On both search heads, and make sure the rows & fields match.

Secondly, are the files populated by a scheduled search? - could it be that you need to run/reschedule the search to populate it?