Could not load lookup=LOOKUP-record_type

[xenomorph]

 WE updated the Sysmon add-on from 3.x to 4.0.1 (latest) on a search head cluster. After, we're getting errors about how the node we're on and the indexers can't load a lookup

(Could not load lookup=LOOKUP-record_type).

[xenomorph]

many thanks to Ryan McGinn

[xenomorph]

In Splunk_TA_microsoft_sysmon\default\app.conf or Splunk_TA_microsoft_sysmon\local\app.conf add the following then deploy the SHC bundle 

[shclustering]
deployer_lookups_push_mode = always_overwrite

In the app.conf seems the best way for the sysmon TA

[xenomorph]

the -preserve-lookups true option when we did the SHC bundle push and the add-on's 3.x version of the lookup had a different field name (record_type ) vs the version in 4.x which is record_type_id.