topic Re: Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"? in Splunk Search

Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

JakeConcur — Thu, 18 Sep 2014 19:29:52 GMT

Incident:
ERROR LookupOperator - The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration ...

...where configurations belongs to learned app.

How to solve it, please? How to create dropdownsLookup?

Thanks

Re: Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

jeremiahc4 — Thu, 18 Sep 2014 19:44:56 GMT

Did you add an automatic lookup called "dropdownsLookup" in a different app? Apparently even though you add a lookup in an app, other apps can see it if you define it by a common sourcetype. At least that is my experience at the moment. I asked a similar question recently.

http://answers.splunk.com/answers/148810/why-other-apps-are-calling-a-lookup-that-is-not-globally-shared-and-causing-errors.html

Re: Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

srioux — Thu, 18 Sep 2014 19:52:38 GMT

App scoping could be a problem. If the auto-lookups exist in one app & shared Globally, where the lookup definition isn't, could cause some problems.

Re: Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

rlacher1 — Tue, 24 May 2016 13:27:51 GMT

As @jeremiahc4 and @srioux mentioned in the comments, fixing the app scoping addressed a similar problem I had where I was receiving an ERROR LookupOperator - The lookup table... error.

Go to Settings > Lookups > Automatic Lookups and ensure that the Sharing for your automatic lookup is set to App, not Global. Prior to this I had noticed that the lookup didn't exist in my app's local.meta file either, and after I set the permissions from Global to App it appeared correctly.

Re: Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

yannK — Mon, 18 Sep 2023 21:50:10 GMT

Since 2020s the dropdown lookup moved to ITSI content pack app

There is a content pack DA-ITSI-CP-unix-dashboards that contains an automatic lookup for some sourcetypes.

The lookup is Lookup-dropdowns, relying on a csv lookup named dropdowns.csv. And coupled with an automatic lookup named "dropdownsLookup".
The issue was that the csv lookup is not shipped with the app, but is being created/updated by a scheduled search "dropdowns_lookup_migrate"
That scheduled search was running, but failed to create the lookup because of fields names issues.
As a consequence, every time a search triggers the automatic lookup, the lookup throw an error because it does not find the csv file to load.

To address the issue :
- we ran the search "dropdowns_lookup_migrate" manually (without the append=t) to create the dropdowns lookup manually once to create the base lookup with the correct fields.

If you have no entities, the lookup has only one line with "all_hosts".
- then we waited for the search bundle to replicate to the indexers
After that, the lookup error stopped.