topic Re: Splunk lookup in Splunk Search

Splunk lookup

santhipriya — Tue, 22 Oct 2024 08:34:08 GMT

I have a 3 node search head cluster and distributed indexers we are getting below error when running any type of search . suggest any ways to avoid it

error: (indexers)..........of 41 peers omitted] Could not load lookup=LOOKUP-connect_glpi

Re: Splunk lookup

gcusello — Tue, 22 Oct 2024 08:53:22 GMT

Hi @santhipriya ,

the message is saying the there's a missed loookup (probaly automatic) in your search head cluster.

you have to understand in which app it's located and then create or disable it.

Ciao.

Giuseppe

Re: Splunk lookup

santhipriya — Thu, 24 Oct 2024 11:45:39 GMT

Hi @gcusello

I was able to find out those in automatic lookups and deleted ,the errors are fixed now . Thanks.!

Re: Splunk lookup

gcusello — Thu, 24 Oct 2024 16:27:45 GMT

Hi @santhipriya ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Splunk lookup

gcusello — Wed, 27 Nov 2024 08:14:58 GMT

Hi @santhipriya ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉