Splunk Search

Error message while searching from the search head

adidibra
Engager

Hello,

I am getting the following error while searching in splunk.

  • Could not load lookup=LOOKUP-cisco_pix_severity_lookup
  • Could not load lookup=LOOKUP-citrix_netscaler_availability_status
  • Could not load lookup=LOOKUP-citrix_netscaler_ha_states
  • Could not load lookup=LOOKUP-f5_icontrol_availability_status
  • Could not load lookup=LOOKUP-f5_icontrol_ha_states

I copied the apps from another splunk deployer and now I getting these errors. I see the lookup csv files are there but still the error persists.

Am I missing something? Please advise.

Thanks

Labels (1)
0 Karma

tscroggins
Influencer

@adidibra 

In a distributed environment, check each app's default/distsearch.conf and local/distsearch.conf on the search head for replicationSettings:refineConf, replicationWhitelist, and replicationBlacklist stanzas that may be preventing the lookups from being added to the knowledge bundle.

0 Karma

adidibra
Engager
@tscroggins Thanks for the advice
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...