topic Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity in Splunk Search

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

SplunkNinja — Fri, 10 May 2024 21:21:44 GMT

I am seeing the following alert on the Searching and Reporting App and also within the InfoSec App for Splunk.

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

I am not sure how to go about troubleshooting this further. Thx.

Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

gcusello — Sat, 11 May 2024 06:31:15 GMT

search in the lookups and in the lookup definitions the automatic lookup named "threatprotect-severity", probably it's missed or there are some missed fields, called by your searches, in the lookup definition.

Ciao.

Giuseppe

Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

PickleRick — Sat, 11 May 2024 07:27:50 GMT

And check permissions. The lookup itself might be OK but you might not have permissions to use it.

Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

SplunkNinja — Tue, 14 May 2024 12:53:56 GMT

I narrowed the issue down to an add-on and then updated to the latest version. This fixed the problem. Thanks for you help @gcusello and @PickleRick

Re: [idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

gcusello — Tue, 14 May 2024 13:10:13 GMT

Hi @SplunkNinja ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉