I'm seeing the below errors when searching on a few different types of indexes:
7 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
[indexer1] The lookup table 'MSADGroupType' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'nix_action_lookup' does not exist. It is referenced by configuration 'aws:ec2:unix'.
[indexer1] The lookup table 'windows_action_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_app_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_audit_changes_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_privilege_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_vendor_info_lookup' does not exist. It is referenced by configuration 'windows:ad'.
I checked the lookups and also the lookup table rights and the permissions are correct and also they are set as Global.
In the same application we were able to do a | inputlookup , and it showed up without any errors in the application.
We also checked the indexer and it is running fine.
Check $SPLUNk_HOME/var/log/splunkd.log on indexer1 to check if it is having issue untaring the knowledge bundle so it wasn't getting the full list of apps which include the lookup .csv files referenced by the automatic lookups.
11-18-2016 16:33:11.014 -0500 ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576299.bundle host = Searchheadxx source = /opt/splunkcoreengine/ce_test/0014000000KBwIuAAL/1201882/icpmccd00444-idx_-20181118-224515/log/splunkd.log.2 sourcetype = splunkd
11-18-2016 16:33:11.014 -0500 WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576263.de2caca0e2c86dcc.tmp -> /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576263: Directory not empty
We deleted all bundles associated to that SHC guid BA8C0856-2B86-46A6-A96A-8C429957F1CE on the indexer1 in /opt/splunk/var/run/searchpeers
rm -rf BA8C0856-2B86-46A6-A96A-8C429957F1CE*
and ran another search to trigger a new bundle replication.
After that the indexer1 successfully untarred the bundle and the issue is resolved.