topic Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR in Dashboards & Visualizations

HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

aditsss — Wed, 28 Oct 2020 07:24:16 GMT

Hi Everyone,

My splunk instance has been migrated. When I am searching for the index I am getting Below ERRORS: I FOUND THESE LOOKUPS IN MY AUTOMATIC LOOKUPS.

I checked the permission. Its GLOBAL only . How can I remove the these Errors.

Can someone guide me on this.

index="ABC"

[hvidltwa13] Could not load lookup=LOOKUP-SFDC-DASHBOARD1
[hvidltwa13] Could not load lookup=LOOKUP-SFDC-REPORT1
[hvidltwa13] Could not load lookup=LOOKUP-SFDC-USER_AGENT
[hvidltwa13] Could not load lookup=LOOKUP-SFDC-USER_NAME
[hvidltwa13] Could not load lookup=LOOKUP-SFDC-USER_NAME1

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

gcusello — Wed, 28 Oct 2020 07:37:24 GMT

Hi @aditsss,

you already did the same answer, please see my answers to it https://community.splunk.com/t5/Dashboards-Visualizations/How-to-fix-quot-Could-not-load-lookup-Error/m-p/526425/highlight/false#M35725

ciao.

Giuseppe

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

aditsss — Wed, 28 Oct 2020 07:47:34 GMT

@gcusello

Do I need to reinstall the app or exactly what I need to do . Can you guide me.

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

gcusello — Wed, 28 Oct 2020 07:52:14 GMT

Hi @aditsss,

if your app has a lower version, upgrade it to the last one.

if it has the same version, extract the app files in anothe folder and copy them on the app folder (then restart Splunk).

Ciao.

Giuseppe

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

aditsss — Wed, 28 Oct 2020 07:59:04 GMT

@gcusello

I am able to see this version when I run below command in search:

| rest /services/apps/local | search disabled=0 core=0|dedup label | table label version

From where I need to compare the version?

EP DevOps

1.0.0

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

aditsss — Wed, 28 Oct 2020 08:11:50 GMT

Hi @gcusello The version is fine I checked in another Environment also I am using the same version but its running fine

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

gcusello — Wed, 28 Oct 2020 08:14:15 GMT

Hi @aditsss,

you have to compare your app version (that you can see also by GUI in [Apps -- Manage Apps -- choose Salesforce apps -- Edit properties] with the one that you can find in apps.splunk.com.

For salesforce apps:

Splunk App for Salesforce vers. 3.0.0
Splunk Add-On for Salesforce vers. 4.0.2

Ciao.

Giuseppe

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

gcusello — Wed, 28 Oct 2020 08:17:05 GMT

Hi @aditsss,

have in the other environments the same automatic lookups or not?

you could copy the app from the other environment in the one with errors.

Ciao.

Giuseppe

Re: HOW TO REMOVE COULD NOT LOAD LOOKUP ERROR

Ashwini008 — Wed, 28 Oct 2020 10:17:00 GMT

@aditsss Recently one of our user had faced the same issue. The reason behind that was the UF was not installed Properly.

Make sure your getting data from the UF to your splunk instance. In our case the outputs.conf on UF was not defined with correct port number. Once the port number defined on outputs.conf was corrected(receiving port number :9997) ,the error was removed.