https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-adding-head-1-1-fix-this-strange-lookup-error/m-p/467483#M7008 <P>Both queries work on our non ES server; however, only the first query works on our ES server.</P> <P>This query works in both places:</P> <PRE><CODE>index=myIndexFile | head (1==1) | lookup myserverlist my_host </CODE></PRE> <P>This query throws the following error on our ES server:<BR /> Streamed search execute failed because: "[IndexServerName] Error in 'lookup' command: Could not construct lookup 'myserverlist , my_host'. See search.log for more details.." I've looked at the search.log file and found nothing useful.</P> <PRE><CODE>index=myIndexFile | lookup myserverlist my_host </CODE></PRE> Mon, 06 Apr 2020 18:48:21 GMT compuchip 2020-04-06T18:48:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-adding-head-1-1-fix-this-strange-lookup-error/m-p/467483#M7008 <P>Both queries work on our non ES server; however, only the first query works on our ES server.</P> <P>This query works in both places:</P> <PRE><CODE>index=myIndexFile | head (1==1) | lookup myserverlist my_host </CODE></PRE> <P>This query throws the following error on our ES server:<BR /> Streamed search execute failed because: "[IndexServerName] Error in 'lookup' command: Could not construct lookup 'myserverlist , my_host'. See search.log for more details.." I've looked at the search.log file and found nothing useful.</P> <PRE><CODE>index=myIndexFile | lookup myserverlist my_host </CODE></PRE> Mon, 06 Apr 2020 18:48:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-adding-head-1-1-fix-this-strange-lookup-error/m-p/467483#M7008 compuchip 2020-04-06T18:48:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-adding-head-1-1-fix-this-strange-lookup-error/m-p/467484#M7009 <P>The <CODE>lookup</CODE> command is a <STRONG>distributable streaming command</STRONG> when <STRONG>local=false</STRONG>, which is the default setting. And distributable streaming command runs on indexer servers. So in your second query lookup is running on indexer server: <CODE>[IndexServerName]</CODE> and failing as it is not created there. You need to provide <STRONG>local=true</STRONG> in lookup command to run it on search heads.</P> <PRE><CODE>index=myIndexFile | lookup local=true myserverlist my_host </CODE></PRE> <P><STRONG>Why the first query works?</STRONG><BR /> it is using <CODE>head</CODE> command which is a <STRONG>centralized streaming command</STRONG> which only runs on search heads. Before <CODE>head</CODE> command executed indexers send the results to the search head and all the next commands will be run on search head only. So in this case <CODE>lookup</CODE> will be run on search head so it works.</P> <P>Check this link to understand this better: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Writebettersearches#Parallel_processing_example">https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Writebettersearches#Parallel_processing_example</A></P> <P>Check below links for more info:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Typesofcommands">https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Typesofcommands</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commandsbytype">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commandsbytype</A></P> Tue, 07 Apr 2020 06:10:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-adding-head-1-1-fix-this-strange-lookup-error/m-p/467484#M7009 manjunathmeti 2020-04-07T06:10:44Z