topic Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials in Splunk Search

Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

mah — Mon, 12 Jun 2023 13:48:37 GMT

Hi,

I wanted to update splunk_security_essentials app (3.2.2 to 3.3.2) : after I did the restart, I have this error under all searches :

"Could not load lookup=LOOKUP-splunk_security_essentials"

I found out that there is an automatic lookup set like that :

I did a btool command and see this :

opt/splunk/bin/splunk btool props list --debug |grep LOOKUP-splunk_security_essentials

/opt/splunk/etc/apps/Splunk_Security_Essentials/default/props.conf LOOKUP-splunk_security_essentials = sse_content_exported_lookup search_title AS search_name OUTPUTNEW

What can I do to remove this error ?

Thanks for your help!

Re: Could not load lookup=LOOKUP-splunk_security_essentials

aaron_barrett — Wed, 10 Nov 2021 08:01:46 GMT

I am also encountering this error on 3.4.0. Have you found a solution? Considering trying a rollback.

Re: Could not load lookup=LOOKUP-splunk_security_essentials

davvik — Tue, 01 Feb 2022 20:53:34 GMT

Did you manage to solve this?

Re: Could not load lookup=LOOKUP-splunk_security_essentials

tro — Fri, 02 Dec 2022 10:25:13 GMT

Same issue 😕

Re: Could not load lookup=LOOKUP-splunk_security_essentials

esafaei — Mon, 12 Jun 2023 09:07:15 GMT

Hi there!

I had same issue after upgrading from version 9.0.4.1 to 9.0.5.

The upgrade process had been started by root user and I had Permission issues with different files.

In my experience running the below command resolved the issue.

# chown -R splunk:splunk /opt/splunk

Good luck!

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

splunkreal — Tue, 20 Jun 2023 09:34:14 GMT

Hello, this issue has been seen in test environment not in production so we removed it from test environment without resolution.

Re: Could not load lookup=LOOKUP-splunk_security_essentials

splunkreal — Tue, 20 Jun 2023 09:34:39 GMT

Hello,

this didn't help, hopefully this only happened in test env.

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

joshiro — Tue, 18 Jul 2023 15:40:44 GMT

We recently encounter a similar error on some searches and we found out that the source of the problem was the KVStore failing to initialize because expired certificates.

After renewing the web certificates the error no longer shows up.

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

m_pham — Wed, 08 Nov 2023 18:20:36 GMT

Are you still having this issue with the latest SSE app v3.7.1?

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

JusAnotherAdmin — Mon, 20 Nov 2023 16:10:43 GMT

I just did a clean install of 9.1.1 and then Splunk Security Essentials 3.7.1 and am getting this error. @m_pham

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

m_pham — Mon, 20 Nov 2023 19:03:11 GMT

There can be various reasons for this issue but here are the common ways to troubleshoot this error.

First and foremost,

- you need to track down the automatic lookup definition

- record the lookup definition name being referenced

- find the lookup definition and record the lookup table name and then go check the following:

Check if your lookup file exist - you can use the Lookup Editor app to check this or go to: Settings > Lookups > Lookup table files
Check if your lookup definition exist - you can check this by going to Settings > Lookups > Lookup definition If you are using an automatic lookup check the following:
1. Do you have the correct read permission to the lookup definition and lookup table?
2. If the permissions are correct, check the lookup table size (see step #3)
If you are using the lookup command:
1. Do you have permission to the lookup table or lookup definition?
2. Does your lookup definition exist?
3. Does your search runs fine with adding local=true to your lookup command? This means that your lookup isn't being replicated to the indexer cluster, see step #4.
Rare that this happens, but check the lookup table size for the lookup listed in the automatic lookup and check if it exceeds the size defined in [replicationSettings] in distsearch.conf. If the lookup table exceeds whatever size is defined there, the lookup error comes up.
Check if the lookup being used is in the deny list under distsearch.conf
1. btool distsearch list replicationBlacklist --debug
2. btool distsearch list replicationDenylist--debug

Update:
- I installed SSE app v3.7.1 on a new Nix host with Splunk v9.1.1 and I didn't see any lookup errors when I run a search. So I recommend you follow the troubleshooting steps above since I can't replicate the issue with a fresh app and Splunk install.

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

Orange_girl — Mon, 11 Dec 2023 08:45:39 GMT

Hi, I’m new to splunk and getting the same error message after upgrading splunk and the security essentials apps.
could you please help me understand how I can perform these steps:

First and foremost,

- you need to track down the automatic lookup definition

- record the lookup definition name being referenced

- find the lookup definition and record the lookup table name

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

m_pham — Tue, 12 Dec 2023 16:18:56 GMT

Hi - the numbered list provided step by step instructions on searching for the items I mentioned. In addition, the lookup errors you see in the UI usually tells you the name of the lookup related configuration that's having problems.

This doc page should help:

https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutlookupsandfieldactions#Lookup_definitions

Re: Could not load lookup=LOOKUP-splunk_security_essentials

ChocolateRocket — Sat, 10 Feb 2024 16:27:41 GMT

New Windows install and getting this error.

Wish there was a simple fix as its polluting our POC for a large purchase to get away from other product(s).

Re: Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials

ChocolateRocket — Sat, 10 Feb 2024 18:04:48 GMT

i renamed and replaced the directory with fresh download.

Error has gone away but wondering if I broke a Security app that may have altered the files.

Splunk is so massively large that its daunting for Newbs. 🙂

Glad I seemed to have gotten rid of the error though.