When searching on a few different indexes, why am I getting the following errors : "The lookup table...does not exist"

[rbal_splunk]

I'm seeing the below errors when searching on a few different types of indexes:

7 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

[indexer1] The lookup table 'MSADGroupType' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'nix_action_lookup' does not exist. It is referenced by configuration 'aws:ec2:unix'.
[indexer1] The lookup table 'windows_action_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_app_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_audit_changes_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_privilege_lookup' does not exist. It is referenced by configuration 'windows:ad'.
[indexer1] The lookup table 'windows_vendor_info_lookup' does not exist. It is referenced by configuration 'windows:ad'.

I checked the lookups and also the lookup table rights and the permissions are correct and also they are set as Global.

In the same application we were able to do a | inputlookup , and it showed up without any errors in the application.

We also checked the indexer and it is running fine.

[rbal_splunk]

Check $SPLUNk_HOME/var/log/splunkd.log on indexer1 to check if it is having issue untaring the knowledge bundle so it wasn't getting the full list of apps which include the lookup .csv files referenced by the automatic lookups.

 11-18-2016 16:33:11.014 -0500 ERROR DistBundleRestHandler - Problem untarring file: /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576299.bundle     host = Searchheadxx source = /opt/splunkcoreengine/ce_test/0014000000KBwIuAAL/1201882/icpmccd00444-idx_-20181118-224515/log/splunkd.log.2 sourcetype = splunkd

    11-18-2016 16:33:11.014 -0500 WARN DistBundleRestHandler - There was a problem renaming: /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576263.de2caca0e2c86dcc.tmp -> /opt/splunk/var/run/searchpeers/BA8C0856-2B86-46A6-A96A-8C429957F1CE-1542576263: Directory not empty

We deleted all bundles associated to that SHC guid BA8C0856-2B86-46A6-A96A-8C429957F1CE on the indexer1 in /opt/splunk/var/run/searchpeers

rm -rf BA8C0856-2B86-46A6-A96A-8C429957F1CE*

and ran another search to trigger a new bundle replication.

After that the indexer1 successfully untarred the bundle and the issue is resolved.