https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391030#M4223 <P>The lookup file may indeed be missing, but you must add it in the right place. The search app is not the right place.<BR /> Go to Settings-&gt;Lookups-&gt;Lookup Definitions and look for the reported lookup. There you will see the name of the lookup file being used and the app which defines it. Create a replace lookup file by the same name in that app and the error should go away.</P> Thu, 04 Apr 2019 16:31:54 GMT richgalloway 2019-04-04T16:31:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391029#M4222 <P>I am new to the Splunk admin role and am having troubles with some errors. When a search is conducting I can see errors coming from all indexers. Starting with [indexer] Could not load lookup=LOOKUP-known_malicious_domains. This is in ES, and I've reviewed splunkd log, var run log, and cannot find additional information on where to look for this lookup. I have tried to manually add this lookup in search with no avail. I have made lookup tables in the search-heads with this filename in etc/apps/search/lookups/known_malicious_domains but that does not seem to help. Anyone else ran into this before?</P> Tue, 29 Sep 2020 23:57:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391029#M4222 walsborn 2020-09-29T23:57:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391030#M4223 <P>The lookup file may indeed be missing, but you must add it in the right place. The search app is not the right place.<BR /> Go to Settings-&gt;Lookups-&gt;Lookup Definitions and look for the reported lookup. There you will see the name of the lookup file being used and the app which defines it. Create a replace lookup file by the same name in that app and the error should go away.</P> Thu, 04 Apr 2019 16:31:54 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391030#M4223 richgalloway 2019-04-04T16:31:54Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391031#M4224 <P>Worked! Thanks Rich!</P> Mon, 08 Apr 2019 15:34:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-find-a-Missing-Lookup/m-p/391031#M4224 walsborn 2019-04-08T15:34:40Z