https://community.splunk.com/t5/Splunk-Enterprise-Security/One-lookup-different-error/m-p/740688#M12397 <P>I have a lookuop that have domain names, I am already using this lookup in a search and its working fine, now I am trying to construct a new search based on same lookup and I get below error.</P><P>&nbsp;</P><UL><LI>[indexer1,indexer2,indexer3,indexer4] The lookup table 'lookup.csv' does not exist or is not available.</LI></UL><P>the lookup is configured to run for all apps and roles.</P><P>both searches are running on ES. 1 has error and other doesnt why?</P> Tue, 04 Mar 2025 08:31:03 GMT Nawab 2025-03-04T08:31:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/One-lookup-different-error/m-p/740688#M12397 <P>I have a lookuop that have domain names, I am already using this lookup in a search and its working fine, now I am trying to construct a new search based on same lookup and I get below error.</P><P>&nbsp;</P><UL><LI>[indexer1,indexer2,indexer3,indexer4] The lookup table 'lookup.csv' does not exist or is not available.</LI></UL><P>the lookup is configured to run for all apps and roles.</P><P>both searches are running on ES. 1 has error and other doesnt why?</P> Tue, 04 Mar 2025 08:31:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/One-lookup-different-error/m-p/740688#M12397 Nawab 2025-03-04T08:31:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/One-lookup-different-error/m-p/740692#M12398 <P>It sounds like your lookup has not been replicated to the lookups. What does your architecture look like?&nbsp;</P><P>Try adding local=true to your lookup command, does it work then? That might help us work out what the issue might be.</P><P>Please let me know how you get on and consider adding karma to this or any other answer if it has helped.<BR />Regards</P><P>Will</P> Tue, 04 Mar 2025 08:44:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/One-lookup-different-error/m-p/740692#M12398 livehybrid 2025-03-04T08:44:44Z