Splunk Search

Error message while searching from the search head

adidibra
Engager

Hello,

I am getting the following error while searching in splunk.

  • Could not load lookup=LOOKUP-cisco_pix_severity_lookup
  • Could not load lookup=LOOKUP-citrix_netscaler_availability_status
  • Could not load lookup=LOOKUP-citrix_netscaler_ha_states
  • Could not load lookup=LOOKUP-f5_icontrol_availability_status
  • Could not load lookup=LOOKUP-f5_icontrol_ha_states

I copied the apps from another splunk deployer and now I getting these errors. I see the lookup csv files are there but still the error persists.

Am I missing something? Please advise.

Thanks

Labels (1)
0 Karma

tscroggins
Influencer

@adidibra 

In a distributed environment, check each app's default/distsearch.conf and local/distsearch.conf on the search head for replicationSettings:refineConf, replicationWhitelist, and replicationBlacklist stanzas that may be preventing the lookups from being added to the knowledge bundle.

0 Karma

adidibra
Engager
@tscroggins Thanks for the advice
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...