Error in Automatic Lookup arista_switch_log : LOOKUP-syslogseverity

[lucilleddajab]

Hi, 

We are going back and forth with Splunk support on an error coming from your automatic lookup as we can't seem to correct this from our end (no edit option on Splunk Cloud web console). And we need your help in fixing this. This error shows up when we run some correlation searches.

x-------------------------Start of ERROR---------------------------------x

Cannot expand lookup field 'severity' due to a reference cycle in the lookup configuration. Check search.log for details and update the lookup configuration to remove the reference cycle.
x-------------------------End of ERROR----------------------------------x

This error happens if one field is present in both input and output field in an automatic lookup.

Splunk is saying the error is generating from "arista_switch_log : LOOKUP-syslogseverity" automatic lookup. The configs in this lookup needs to be corrected by removing the severity field from the output field. Current settings:
syslogseverity severity OUTPUTNEW severity severity_desc

Recommended settings by Splunk to avoid reference cycle error:
syslogseverity severity OUTPUTNEW severity_desc

Please assist.

[rishabhshah]

Can try this setting if it helps - syslogseverity severity OUTPUTNEW severity AS severity_auto severity_desc

Please refer to https://community.splunk.com/t5/Splunk-Cloud-Platform/Why-can-I-not-expand-lookup-field-due-to-a-ref...