topic What is the root cause of Splunk lookup error &quot;'Could not find all of the specified destination fields in the lookup table.'&quot;? in Splunk Search https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324053#M96719 <P>Hi,</P> <P>I have a setup with 4 Search heads, 6 indexers and many forwarders.</P> <P>I keep seeing the below error in splunkd.log (of the search head alone),</P> <PRE><CODE>02-23-2017 08:51:10.138 -0500 ERROR LookupOperator - Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'host::*' and lookup table 'SampleLookupDefinition' </CODE></PRE> <P>This error occurs in the search head alone. I am able to run Splunk searches and retrieve data successfully.<BR /> Please help me fix it.</P> <P><STRONG>UPDATE:</STRONG> This error got fixed when I deleted and recreated the automatic lookup. But I want to find the root cause.<BR /> Thanks,<BR /> Deepak</P> Thu, 23 Feb 2017 16:59:35 GMT deepak02 2017-02-23T16:59:35Z What is the root cause of Splunk lookup error "'Could not find all of the specified destination fields in the lookup table.'"? https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324053#M96719 <P>Hi,</P> <P>I have a setup with 4 Search heads, 6 indexers and many forwarders.</P> <P>I keep seeing the below error in splunkd.log (of the search head alone),</P> <PRE><CODE>02-23-2017 08:51:10.138 -0500 ERROR LookupOperator - Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'host::*' and lookup table 'SampleLookupDefinition' </CODE></PRE> <P>This error occurs in the search head alone. I am able to run Splunk searches and retrieve data successfully.<BR /> Please help me fix it.</P> <P><STRONG>UPDATE:</STRONG> This error got fixed when I deleted and recreated the automatic lookup. But I want to find the root cause.<BR /> Thanks,<BR /> Deepak</P> Thu, 23 Feb 2017 16:59:35 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324053#M96719 deepak02 2017-02-23T16:59:35Z Re: What is the root cause of Splunk lookup error "'Could not find all of the specified destination fields in the lookup table.'"? https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324054#M96720 <P>Basically, somewhere there was a lookup defined that had erroneous or misspelled fields in it.</P> <P>Say your lookup table KeyFoo is defined like this </P> <PRE><CODE>Key1 Key2 Foo1 Foo2 Bar </CODE></PRE> <P>And let's say that something like one of these searches is defined</P> <PRE><CODE>| lookup KeyFoo Key1 OUTPUT Foo3 | lookup KeyFoo Key2 FOo2 OUTPUT FOo1 | lookup KeyFoo Key1 Foo2 OUTPUT FOo1 Bar </CODE></PRE> <P>The system is saying that you're trying to match up with / output something that isn't actually on the table.</P> Thu, 23 Feb 2017 20:33:49 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324054#M96720 DalJeanis 2017-02-23T20:33:49Z Re: What is the root cause of Splunk lookup error "'Could not find all of the specified destination fields in the lookup table.'"? https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324055#M96721 <P>Thankyou.</P> <P>I deleted and recreated the automatic lookup with the exact same config, and it works now.</P> <P>Could it be a system/software problem?</P> Thu, 23 Feb 2017 20:55:25 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-root-cause-of-Splunk-lookup-error-quot-Could-not/m-p/324055#M96721 deepak02 2017-02-23T20:55:25Z