Just went through something similar. A useful app is the lookup editor on Splunkbase. It can identify duplicate lookups in different locations. For example: I moved to using an app for my CIDR lookups, and forgot to remove the local subnets.csv from /etc/apps/search/lookups/ on my search head
... View more
Just wanted to say thanks for coming back and posting an answer. Had this issue today, and a splunkd restart on the deployment server worked perfectly.
... View more