topic How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration in Splunk Cloud Platform

How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

lukmanfikri — Fri, 30 Sep 2022 19:29:41 GMT

I got error message after upgrading splunk enterprise from version 8.1 to version 8.2.7

in all my splunk dashboard, it shows warning with message : cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

can you tell me how to fix this issue?

thank you

Re: How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

VatsalJagani — Sat, 01 Oct 2022 08:21:40 GMT

@lukmanfikri - This situation occurs when lookup definition configured badly. Detailed about it documented here - https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/DefineanautomaticlookupinSplunkWeb ("Avoid creating automatic lookup reference cycles")

You can troubleshoot by greping for "LOOKUP" and "hostname" under all props.conf definition.

I hope this helps!!!

Re: How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

inventsekar — Sat, 01 Oct 2022 10:16:35 GMT

Hi @lukmanfikri ... At the end of this post, there is a good step by step method.. pls check it out...

https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-reference-cycle-in/m-p/543455