All Apps and Add-ons

Getting error message - "Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' and lookup table 'customers'."

Arpit_S
Path Finder

Hi,

We are getting below error message in our instance,

[idxXX.sharefile.splunkcloud.com] Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' and lookup table 'customers'.

This csv customers belongs to Chargeback app, as there was an update for the app available, the app was updated . Since then we are getting these errors.

There is another instance where we have this app installed and was updated as well. But we aren't getting any error messages in that instance.

The fields in the two lookups are exactly the same. The only difference is on one instance the permission for the lookup is set to "Global" {the one on which we are getting errors} and on the other it is set to "App".

Version of instance with errors – 6.5.1
Version of instance without errors – 6.5.1612

Please let us know how can this issue be resolved.

Thanks,
Arpit

0 Karma

nickhills
Ultra Champion

It sounds like you have a column missing from one of the files.

Try running:

|inputlookup <name of lookup> 

On both search heads, and make sure the rows & fields match.

Secondly, are the files populated by a scheduled search? - could it be that you need to run/reschedule the search to populate it?

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...