Splunk Search

Error message while searching from the search head

adidibra
Engager

Hello,

I am getting the following error while searching in splunk.

  • Could not load lookup=LOOKUP-cisco_pix_severity_lookup
  • Could not load lookup=LOOKUP-citrix_netscaler_availability_status
  • Could not load lookup=LOOKUP-citrix_netscaler_ha_states
  • Could not load lookup=LOOKUP-f5_icontrol_availability_status
  • Could not load lookup=LOOKUP-f5_icontrol_ha_states

I copied the apps from another splunk deployer and now I getting these errors. I see the lookup csv files are there but still the error persists.

Am I missing something? Please advise.

Thanks

Labels (1)
0 Karma

tscroggins
Influencer

@adidibra 

In a distributed environment, check each app's default/distsearch.conf and local/distsearch.conf on the search head for replicationSettings:refineConf, replicationWhitelist, and replicationBlacklist stanzas that may be preventing the lookups from being added to the knowledge bundle.

0 Karma

adidibra
Engager
@tscroggins Thanks for the advice
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...