How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

[lukmanfikri]

Hi

I got error message after upgrading splunk enterprise from version 8.1 to version 8.2.7

in all my splunk dashboard, it shows warning with message : cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

can you tell me how to fix this issue?

thank you

[inventsekar]

Hi @lukmanfikri ... At the end of this post, there is a good step by step method.. pls check it out...

https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-ref...

[VatsalJagani]

@lukmanfikri - This situation occurs when lookup definition configured badly. Detailed about it documented here - https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/DefineanautomaticlookupinSplunkWeb ("Avoid creating automatic lookup reference cycles")

You can troubleshoot by greping for "LOOKUP" and "hostname" under all props.conf definition.

I hope this helps!!!