Hi,
We are going back and forth with Splunk support on an error coming from your automatic lookup as we can't seem to correct this from our end (no edit option on Splunk Cloud web console). And we need your help in fixing this. This error shows up when we run some correlation searches.
x-------------------------Start of ERROR---------------------------------x
Cannot expand lookup field 'severity' due to a reference cycle in the lookup configuration. Check search.log for details and update the lookup configuration to remove the reference cycle.
x-------------------------End of ERROR----------------------------------x
This error happens if one field is present in both input and output field in an automatic lookup.
Splunk is saying the error is generating from "arista_switch_log : LOOKUP-syslogseverity" automatic lookup. The configs in this lookup needs to be corrected by removing the severity field from the output field. Current settings:
syslogseverity severity OUTPUTNEW severity severity_desc
Recommended settings by Splunk to avoid reference cycle error:
syslogseverity severity OUTPUTNEW severity_desc
Please assist.
