Splunk Indexer giving lookup missing error

sscandoit — Wed, 31 Aug 2011 14:17:01 GMT

Hi All,

I have the following setup in my environment:
1) light forwarder installed on the machine where logs are generated
2) forwarder machine
3) Indexer which can perform search
4) Search head

I have created a view on search head and have saved the regular expressions in props.conf and transforms.conf files on this search head. I am also using a lookup in my view which is stored in $SPLUNK_HOME/etc/system/local/lookups.

When open the view, it displays the data correctly. However it shows message stating lookup file is missing on indexer machine.

I am not able to understand why indexer is also looking for the lookup. Could you please tell me how I can take care of this error? Once again thanks a lot for helping me. This forum has been really helpful to me.

Thanks
Suvelee

Re: Splunk Indexer giving lookup missing error

melting — Thu, 01 Sep 2011 18:29:54 GMT

Lookup search cmd will try to run on the indexers. You can force it to run only of the search head with local=true. Take a look at the docs for input search cmd

Re: Splunk Indexer giving lookup missing error

sscandoit — Fri, 02 Sep 2011 14:01:35 GMT

Thanks for your reply. I will definitely try that.

topic Splunk Indexer giving lookup missing error in Splunk Search

Splunk Indexer giving lookup missing error

Re: Splunk Indexer giving lookup missing error

Re: Splunk Indexer giving lookup missing error