I see lots of errors while searhing on searchhead: "[indexer1] The lookup table 'IPAMLookup' does not exist"

[yaraslau_haradz]

[indexer1] The lookup table 'BlogArticleMonthLookup' does not exist. It is referenced by configuration 'apache_req_blogs'.
[indexer1] The lookup table 'IPAMLookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.

How to fix it?

[esix_splunk]

You have an app / search configured that is using a lookup table that isnt on your indexer[s].

Two possible options-
1) Distribute the app to your indexer[s] that this lookup is contained in. Install that app on the indexers in $splunk_home$/etc/apps

2) Change the searches that are giving you this error to ... | lookup local=true ....

On a side note, depending on what the search does, changing it to a local lookup may result in search results not being properly populated. E.g., some fields may not get properly created or additional fields may not be created.

[martin_mueller]

Check if the automatic lookups defined in Settings -> Lookups -> Automatic Lookups reference existing lookup definitions, and that those definitions reference existing lookup files.

[fdi01]

if you want to see your all lookup file go to :--->> ($SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups).

outputlookup
Save search results to specified static lookup table.
Examples

Write to "usertogroup" lookup table (as specified in transforms.conf).
| outputlookup usertogroup
Write to "users.csv" lookup file (under $SPLUNK_HOME/etc/system/lookups or $SPLUNK_HOME/etc/apps/*/lookups).
| outputlookup users.csv