How to fix "Could not load lookup Error

[aditsss]

Hi Team,

My splunk has been upgraded with new version.

When I search with index I am able to see below Errors:

index="ABC"

Can someone guide me on this.

[gcusello]

Hi @aditsss,

these are automatic lookups from the Salesforce App.

Check if there's another version of this app and anyway reinstall it.

Ciao.

Giuseppe

[aditsss]

How can I check for another version or How Can I reinstall.

When I search for these lookups these are not present in lookup tables nor lookup definations.

How Can I remove this error.

[gcusello]

Hi @aditsss,

as I said, they are  automatic lookups that you can find in props.conf (https://docs.splunk.com/Documentation/Splunk/8.0.6/Knowledge/Makeyourlookupautomatic).

so you should check the version of the installed app (you can find it in [App's settings -- properties] and compare with the one that you can find in splunkbase.

Anyway, some of the lookups you're searching for are in the "Splunk Add-On for Salesforce", not in the "Splunk App for Salesforce".

to reinstall, you can use the GUi or untar the app and the Add-On and copy them in $SPLUNK_HOME/etc/apps and restart Splunk.

Beware because not all the lookup are in the Add-on, maybe the others are custom.

If you want to disable those automatic lookups, you can comment then in props.conf.

Ciao.

Giuseppe

[aditsss]

Can I directly comments them in props .conf and then check the UI.

[gcusello]

Hi @aditsss,

if you do this, you'll never have the errors but probably some dashboard in the SalesForce App will not correctly run.

Obviously, remember to restart Splunk after updates.

Ciao.

Giuseppe

[aditsss]

I am not able to find lookups in props.conf. Is there any other props.conf that you are talking about. I check in my server prop.conf.

[gcusello]

Hi @aditsss,

you can use the btool CLI command.

from CLi run

./splunk cmd btool props list --debug | grep 'LOOKUP-SFDC' > my_props.txt

and see in the txt file where is the automatic lookup definition.

Anyway, they should be from Salesforce App or Add-on or from a custom App.

Ciao.

Giuseppe