Hi,
I'm getting an error on my Search Head when browsing for content related to some LOOKUP directives I have in my apps.
The LOOKUP directives were copied from one of the search peers were they are working.
Currently my problems are: - I'm getting an error stating that this lookup does not exist on one of the search peers (true, because that search peer does not required them) - the LOOKUP directives are not working on the search head.
Any ideas on how this can be solved?
Splunk should automatically move lookup related files to the search peers from the search head. Is this a script-based lookup? If so, there are some intricacies in getting these to work in distributed, since they may land in a different-than-expected directory.
Could you share your configuration and the general mechanism of operation for your lookup?
What are the intricacies for a script based lookup in a distributed environment? For example, dnslookup.