How to find a Missing Lookup

[walsborn]

I am new to the Splunk admin role and am having troubles with some errors. When a search is conducting I can see errors coming from all indexers. Starting with [indexer] Could not load lookup=LOOKUP-known_malicious_domains. This is in ES, and I've reviewed splunkd log, var run log, and cannot find additional information on where to look for this lookup. I have tried to manually add this lookup in search with no avail. I have made lookup tables in the search-heads with this filename in etc/apps/search/lookups/known_malicious_domains but that does not seem to help. Anyone else ran into this before?

[richgalloway · Accepted solution]

The lookup file may indeed be missing, but you must add it in the right place. The search app is not the right place.
Go to Settings->Lookups->Lookup Definitions and look for the reported lookup. There you will see the name of the lookup file being used and the app which defines it. Create a replace lookup file by the same name in that app and the error should go away.

[walsborn]

Worked! Thanks Rich!