Why this error on search head cluster after updating Splunk_TA_Windows?

[TheBravoSierra]

I recently updated Splunk_TA_Windows and am seeing this error on my search head cluster:

[Indexers] Could not load lookup=LOOKUP-user_account_control_property

This is an automatic lookup generated in the default directory of the app. I'm not familiar with it and am not seeing this error on my deployer(standalone) instance. The configs appear the same.

Any help is greatly appreciated.

Thanks

[TheBravoSierra · Accepted solution]

Solution/workaround was to comment out the user_account_control_property lines in the default transforms/props files. 

[VatsalJagani]

It's a scripted lookup in the Windows Add-on. The default behavior of Splunk and in Windows Add-on is to put it as part of distributed search bundle.

So, it seems those settings (distributed search bundle related) have been changed in your environment. And SHC is not pushing the lookup and lookup script to the indexers.

https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/Knowledgebundlereplication

https://docs.splunk.com/Documentation/Splunk/8.2.4/Admin/Distsearchconf

[TheBravoSierra]

I uninstalled the splunk_TA_windows app completely from the search head cluster, and deployed a clean install of the app(so no local directories anywhere). and am still seeing the error.  

[VatsalJagani]

Use btool to search those attributes in the environment.

* $SPLUNK_HOME/bin/splunk btool distsearch list --debug

(To see what are the attributes set related to distributed search)