Recently we've upgraded from Splunk 7.0.2 to 8.0.2. Splunk is running on a Redhat Linux server. I've installed the corresponding UniversalForwarder 8.0.2 on two Windows servers. Also all installed apps and addons were updated to the most recent versions.
While executing searches or additional apps I keep getting the error "Could not load lookup=LOOKUP-app4_for_windows_security".
Anyone any idea how to solve this ? I'm pretty new to Splunk so any help is appreciated highly.
Hi @woodcock ,
I received this error when I run
| inputlookup windows_app
Do you think what is missing? I run from the search head.
It has to do with the fact that there was a switch in the
sourcetype as differentiator to
source. Start with this search SPL to see the now-broken lookup file data:
If this pulls up data (it definitely will if you go into the
Splunk App for Windows Infrastructure app which is the app that owns this
lookup file), then expand to this SPL and run it to upgrade the
lookup file to be compatible with the changes in the upgraded
| eval sourcetype=source