Why can I not expand lookup field due to a reference cycle in the lookup configuration?

[derekho55]

on Splunk Cloud (8.1.2101.1) I'm encountering a warning message in my search results - trying to figure out why this is popping up. Anybody have any idea what this message means and how to resolve it? 

[gordo32]

What event should I be looking for that tells me exactly which lookup caused the reference cylce? I can't seem to find the relevant event.

Thanks,

Gord T.

[FrankVl]

@gordo32  It doesn't really have anything to do with the events. It is all about your query and how Splunk translates that query into the actual search that is executed.

Splunk uses all the props and transforms and lookups that are in scope for your query (e.g. based on the sourcetype you're filtering on) and uses those to translate any search criteria in your main query into actual raw search criteria such that it can match those against the indexes/bloom filters that are created on top of the raw data.

You can get an idea on how that works by performing a search that includes some criteria that are derived through props/transforms/lookups, then opening the job inspector, scroll down, open the search properties and compare the eventSearch to the normalizedSearch. 

[radam2000]

Thanks rayl

I am on splunk cloud version 8.2.2104.1 and am scheduled for upgrade on August 11th ... will have to wait for the upgrade to find it...

Rich

[radam2000]

OK my splunk cloud instance has been upgraded to ...
Splunk Cloud
Version: 8.2.2107
Build:2e4da17c2b37

and I have fixed my issue ... thank you for all the feedback on this thread - it is much appreciated...

Rich

[Saurabh_Goyal]

Kindly review lookup - sfdc:loginhistory : LOOKUP-SFDC-USER_NAME

I tried saving the lookup, but it dint help.