Splunk Cloud Platform

How to resolve error: cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

lukmanfikri
New Member

Hi

I got error message after upgrading splunk enterprise from version 8.1 to version 8.2.7

in all my splunk dashboard, it shows warning with message : cannot expand lookup field 'hostname' due to a reference cycle in the lookup configuration

can you tell me how to fix this issue?

 

thank you

Labels (2)
Tags (1)
0 Karma

inventsekar
Ultra Champion

Hi @lukmanfikri ... At the end of this post, there is a good step by step method.. pls check it out...

https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-ref...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@lukmanfikri - This situation occurs when lookup definition configured badly. Detailed about it documented here - https://docs.splunk.com/Documentation/Splunk/9.0.1/Knowledge/DefineanautomaticlookupinSplunkWeb ("Avoid creating automatic lookup reference cycles")

 

You can troubleshoot by greping for "LOOKUP" and "hostname" under all props.conf definition.

 

I hope this helps!!!

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...