topic Re: error in search splunk indexer in Knowledge Management

error in search splunk indexer

kjain041523 — Tue, 07 Apr 2026 08:23:35 GMT

Re: error in search splunk indexer

gcusello — Tue, 07 Apr 2026 08:57:51 GMT

Hi @kjain041523 ,

there's a lookup not found or not existent, probably an automatic lookup.

You shouls search it in the add-ons and check if it's present but not correctly shared or if it isn't present.

In the first case, you have to share it at Global level, in the second case, you have to create it.

Ciao.

Giuseppe

Re: error in search splunk indexer

kknairr — Tue, 07 Apr 2026 10:08:39 GMT

@kjain041523 The lookup error indicates Splunk is attempting to run automatic lookups that reference missing or misconfigured lookup files.

You can try to check the lookup definitions in Splunk Web under Settings > Lookups, confirm that the corresponding CSV files (minemeIdfeeds_src_lookup, minemeIdfeeds_dest_lookup) exist in the app’s lookups or directory. To fix the error, you may either restore the missing files or disable the lookup definitions if they are not needed.

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: error in search splunk indexer

livehybrid — Tue, 07 Apr 2026 14:01:39 GMT

Hi @kjain041523

This error looks to relate to the Splunk_TA_paloalto app - have you customised this app in any way?

Specifically those two lookup definitions are referencing the lookup 'minemeldfeeds_lookup' which is a KVStore - do you have any issues with KV Store on your deployment?

By default these lookup definitions and KV Store definitions are shared globally - have you changed the KV Store definition or permissions at all?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: error in search splunk indexer

PickleRick — Wed, 08 Apr 2026 08:00:41 GMT

1. I'm not sure you meant an indexer in the topic. You typically don't search directly on the indexer if you have tiered architecture.

2. It's usually either because someone fiddled with the config and broke a TA itself or changed permissions so that the lookups are either undefined or (more frequent case) not available due to lack of permission for user's role.