Splunk Enterprise Security

One lookup different error

Nawab
Communicator

I have a lookuop that have domain names, I am already using this lookup in a search and its working fine, now I am trying to construct a new search based on same lookup and I get below error.

 

  • [indexer1,indexer2,indexer3,indexer4] The lookup table 'lookup.csv' does not exist or is not available.

the lookup is configured to run for all apps and roles.

both searches are running on ES. 1 has error and other doesnt why?

Labels (1)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

It sounds like your lookup has not been replicated to the lookups. What does your architecture look like? 

Try adding local=true to your lookup command, does it work then? That might help us work out what the issue might be.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...