Splunk Search

Distributed Searches and Lookup table errors.

eploughe
Engager

I am having a problem with lookup tables in a distributed search environment. The lookup table is working on the main search head but I receive the below error on the secondary Linux instance.

  1. [Linux_Instance] The lookup table 'Windows_EventCode_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.
  2. [Linux_Instance] The lookup table 'W2K3_Logon_Type_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.

The search head is a Windows systems the error is from the Linux Splunk system. I do have export=system setup on both systems and I have created the lookup on the Linux Splunk instance but it still gives me the above error.

mlulmer
Explorer

This is an old question but still very relevant. Did you try adding the lookups to the indexers? I think this might help.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...