Anyone seen this error before?
Error in 'lookup' command: The lookup table 'user_realnames_lookup' does not exist or is not available.
External command based lookup 'user_realnames_lookup' is not available because KV Store initialization has failed. Please contact your system administrator.
Go to Settings>>Lookups » Lookup definitions
and check if user_realnames_lookup
is present or not and if not then create one else check the permission .
@shawno,
1. Stop the splunk server (SH)
2. Go to $SPLUNK_HOME$\var\lib\splunk\kvstore\mongo\
3. Delete mongod.lock and splunk.key file
4. Then Start the splunk server
Now check again