Splunk Search

Lookup Can't Find File

hartfoml
Motivator

I am in a clustered indexer environment and some but not all of my indexers are showing this error

"The lookup table 'org-lookup' does not exist. It is referenced by configuration 'host::*'."

How to I find the file or APP or props.conf that this look-up is referring to?

Thanks in advance for your help.

Tags (1)
0 Karma

Drainy
Champion

Or an even easier Splunk-centric way to find this would be to run from the $SPLUNK_HOME/bin directory;

./splunk cmd btool transforms list --debug | grep org-lookup

Chances are that the lookup exists in the $SPLUNK_HOME/etc/users/ directory somewhere and it just needs to be made public (although there are plenty of other reasons).

It looks like a defined lookup so you could try in Manager and lookups first, it may well be defined in the UI.

Drainy
Champion

btool is one of the most useful commands when troubleshooting Splunk, the --debug flag prepends the app that the config stanza is from to the line. You can run it without and it just won't show you the app context. The most powerful part of btool is that it shows you the applied configuration of all config files

0 Karma

mbenwell
Communicator

btool. I had no idea that existed. Thanks

The lookup location is interesting, I dont have any lookups in $SPLUNK_HOME/etc/users . When I've created lookup files via GUI, I dont specify a filesystem path, just filename and Splunk always seems to put it in the app/looklups directory

0 Karma

mbenwell
Communicator

You should find the reference to the lookup file in transforms.conf. The lookup file itself would typically be in $SPLUNK_HOME/etc/apps//lookups

If on linux the easiest way to find which transforms.conf file that it contains the lookup configuration is to do something like this from the command line:
for i in `locate transforms.conf`; do grep -i5H 'org-lookup' $i; done

The above assumes you have locate installed and up to date.

You should be able to do something similar in Windows

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...