Splunk Enterprise

What is the reason for data missing in lookup table?

Path Finder

Hi All, we have 4 env, sit1, sit2, pat1 and pat2,  We have lookup table from long time,  last 4 months back we have added some data into it, and we verified data was added .

but we are not sure when it got disappear, now we are not able to see that added data in the look up.

what could be the reason for missing? 

Labels (1)
0 Karma


Could you check the modification date on the file? If it was recent you could possibly check the audit log for someone using SPL to overwrite it?

0 Karma


There are a few reasons for data to disappear from a lookup.

1) Someone restored an old backup/export.

2) Someone modified the lookup using the Lookup File Editor app or a CLI editor.

3) Someone ran a search that overwrote the lookup with old data.

There may be other explanations, but none I can think of would be Splunk's doing.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...