Distributed Searches and Lookup table errors.

[eploughe]

I am having a problem with lookup tables in a distributed search environment. The lookup table is working on the main search head but I receive the below error on the secondary Linux instance.

1. [Linux_Instance] The lookup table 'Windows_EventCode_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.
2. [Linux_Instance] The lookup table 'W2K3_Logon_Type_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.

The search head is a Windows systems the error is from the Linux Splunk system. I do have export=system setup on both systems and I have created the lookup on the Linux Splunk instance but it still gives me the above error.

[mlulmer]

This is an old question but still very relevant. Did you try adding the lookups to the indexers? I think this might help.