Splunk Search

Error message while searching from the search head

adidibra
Loves-to-Learn

Hello,

I am getting the following error while searching in splunk.

  • Could not load lookup=LOOKUP-cisco_pix_severity_lookup
  • Could not load lookup=LOOKUP-citrix_netscaler_availability_status
  • Could not load lookup=LOOKUP-citrix_netscaler_ha_states
  • Could not load lookup=LOOKUP-f5_icontrol_availability_status
  • Could not load lookup=LOOKUP-f5_icontrol_ha_states

I copied the apps from another splunk deployer and now I getting these errors. I see the lookup csv files are there but still the error persists.

Am I missing something? Please advise.

Thanks

Labels (1)
0 Karma

tscroggins
Builder

@adidibra 

In a distributed environment, check each app's default/distsearch.conf and local/distsearch.conf on the search head for replicationSettings:refineConf, replicationWhitelist, and replicationBlacklist stanzas that may be preventing the lookups from being added to the knowledge bundle.

0 Karma

adidibra
Loves-to-Learn
@tscroggins Thanks for the advice
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!