Splunk Search

Why am I getting "The lookup table does not exist. It is referenced by configuration" error though I haven't used in my dashboard?

Naren26
Path Finder

I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global.

What's wrong with my Splunk then?

0 Karma

jkat54
SplunkTrust
SplunkTrust

Since you have blacklisted the lookups from the bundle replication, you will have to copy the lookups to the indexers manually.

You can do so by copying the app you’re searching in to the peers/indexers, or you can create a “master” lookup app with all your lookups shared globally.

0 Karma

woodcock
Esteemed Legend

The problem is almost always this:

1: You have an automatic lookup defined: settings -> lookups -> automatic lookups
2: This lookup references a lookup definition that is also defined: settings -> lookups -> lookup definitions
3: This references a lookup file THAT NO LONGER EXISTS. So create it: settings -> lookups -> lookup files

Or disable the automatic lookup.

jneighbors_splu
Splunk Employee
Splunk Employee

Is the lookup table blacklisted in the search bundle?
If the knowledge object does not exist in the bundle this can occur.

arrangineni
Path Finder

I did blacklist the Lookup from the bundle and suddenly I am seeing the errors for lookup axz.csv does not exist for all of my searches, How can I avoid these errors from my searches still keeping the lookup blacklisted from the bundle.

Any ideas on this will be helpful.

0 Karma

jneighbors_splu
Splunk Employee
Splunk Employee

Also validate the props that the config is referencing. I have seen the input be incorrect.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You have created an automatic lookup that is referencing a lookup that doesn’t exist.

Go to settings > lookups > automatic lookups

Search for XXX where XXX is the lookup name that is appearing in error message. Find the auto lookup that is causing the issue and disable / delete it.

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi @Naren26,

for us to help you we need some more information.

Maybe post your search in here you are trying to execute. Or a screenshot or something.

0 Karma

Naren26
Path Finder

@pyro_wood even if I search for everything using "*" I am getting the error.

0 Karma

horsefez
SplunkTrust
SplunkTrust

As I said, you need to provide us with more information, otherwise we won't be able to help you.
That information with "*" isn't helpful at all.

0 Karma

Naren26
Path Finder

@pyro_wood even if I give just a "*" in the search query I am getting the error. The error is being thrown in all the dashboards. I believe the error is not query-specific.

I hope you understand.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...