topic Lookup fails unless using a table in Splunk Search https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488150#M136385 <P>The query below produces the results expected, but if I remove the "table PSID" section (bolded) it fails, saying 22 errors were generated while executing. PSID is a parsed field, bolded in the event record shown. </P> <P>"RA_GENERATED" <STRONG>| table PSID</STRONG> | lookup LocationLookup.csv PeopleSoftId AS PSID OUTPUT Brand</P> <P>Event record:<BR /> 1/16/20 11:23:09.989 AM strong text16 Jan 2020 11:23:09:989 | WARN | K320LE100005 | <STRONG>1019178</STRONG> | XXXR01 | MOSLoggingAspect | - RA_Generated 111 111 111| LangCode en| CountryCode USA</P> Thu, 16 Jan 2020 20:02:09 GMT klhogan 2020-01-16T20:02:09Z Lookup fails unless using a table https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488150#M136385 <P>The query below produces the results expected, but if I remove the "table PSID" section (bolded) it fails, saying 22 errors were generated while executing. PSID is a parsed field, bolded in the event record shown. </P> <P>"RA_GENERATED" <STRONG>| table PSID</STRONG> | lookup LocationLookup.csv PeopleSoftId AS PSID OUTPUT Brand</P> <P>Event record:<BR /> 1/16/20 11:23:09.989 AM strong text16 Jan 2020 11:23:09:989 | WARN | K320LE100005 | <STRONG>1019178</STRONG> | XXXR01 | MOSLoggingAspect | - RA_Generated 111 111 111| LangCode en| CountryCode USA</P> Thu, 16 Jan 2020 20:02:09 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488150#M136385 klhogan 2020-01-16T20:02:09Z Re: Lookup fails unless using a table https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488151#M136386 <P>It sounds like the lookup file is not getting distributed to the indexers. One of the 22 error messages should confirm that.</P> <P>The <CODE>table</CODE> command forces the query to be completed by the search head from that point and the SH is where the lookup file resides.</P> Thu, 16 Jan 2020 20:26:54 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488151#M136386 richgalloway 2020-01-16T20:26:54Z Re: Lookup fails unless using a table https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488152#M136387 <P>I think you're right. Adding a local=true to the lookup seems to work. Thanks!</P> Thu, 16 Jan 2020 20:39:35 GMT https://community.splunk.com/t5/Splunk-Search/Lookup-fails-unless-using-a-table/m-p/488152#M136387 klhogan 2020-01-16T20:39:35Z