All Apps and Add-ons

Why am I getting the error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' in Chargeback Analysis for Splunk on all clustered peer indexers?

uvmk61
New Member

We are getting the following error on all clustered peer indexers after installing the Chargeback App.
I have run the back-fill searches on all search heads as the App installation instructions suggested. Still getting the error.

Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'splunkd' and lookup table 'customers'.

Can someone suggest a resolution to this?
Thanks

0 Karma

rmorlen_splunk
Splunk Employee
Splunk Employee

Change the lookups (all 3 places) from global to App.

0 Karma

uvmk61
New Member

Thank you!
Now the error still shows within the Chargeback App.
The error has disappeared from Search and Reporting App though.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...