topic Re: Could not load lookup=LOOKUP-user_account_control_property in Deployment Architecture

Why this error on search head cluster after updating Splunk_TA_Windows?

TheBravoSierra — Thu, 10 Feb 2022 17:40:55 GMT

I recently updated Splunk_TA_Windows and am seeing this error on my search head cluster:

[Indexers] Could not load lookup=LOOKUP-user_account_control_property

This is an automatic lookup generated in the default directory of the app. I'm not familiar with it and am not seeing this error on my deployer(standalone) instance. The configs appear the same.

Any help is greatly appreciated.

Thanks

Re: Could not load lookup=LOOKUP-user_account_control_property

VatsalJagani — Thu, 10 Feb 2022 06:16:12 GMT

It's a scripted lookup in the Windows Add-on. The default behavior of Splunk and in Windows Add-on is to put it as part of distributed search bundle.

So, it seems those settings (distributed search bundle related) have been changed in your environment. And SHC is not pushing the lookup and lookup script to the indexers.

https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/Knowledgebundlereplication

https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Distsearchconf

Re: Could not load lookup=LOOKUP-user_account_control_property

TheBravoSierra — Thu, 10 Feb 2022 17:37:19 GMT

I uninstalled the splunk_TA_windows app completely from the search head cluster, and deployed a clean install of the app(so no local directories anywhere). and am still seeing the error.

Re: Could not load lookup=LOOKUP-user_account_control_property

VatsalJagani — Fri, 11 Feb 2022 05:00:31 GMT

Use btool to search those attributes in the environment.

* $SPLUNK_HOME/bin/splunk btool distsearch list --debug

(To see what are the attributes set related to distributed search)

Re: Why this error on search head cluster after updating Splunk_TA_Windows?

TheBravoSierra — Wed, 07 Aug 2024 16:50:17 GMT

Solution/workaround was to comment out the user_account_control_property lines in the default transforms/props files.