I keep getting the error message "Could not load lookup=LOOKUP-app_proto" in multiple apps on multiple dashboards. I have checked settings and neither the lookup file or definition existed and I can't figure out what is asking for this lookup. I can't find a reference to a lookup by that name in any documentation or on any of the Splunk sites. I have created a lookup with a matching name but I don't know where to put it. I added it to the search app but I still got the error, then I added it to an app getting the error and that didn't work either. Basic system info is below, let me know what other info you would like and I will provide it as soon as I can. Thanks for reading.
Stand-alone Splunk Enterprise
Apps: (Not all apps listed)
InfoSec App for Splunk (getting error on some dashboards)
Network Traffic App for Splunk (not getting the error)
Cisco Security Suite (getting error on all dashboards)
Obelisk Threat Intel (getting error on all "Splash" page dashboards)
Splunk Security Essentials (getting error on "app awareness" dashboards)
Splunk Stream (getting error on all informational dashboards)
Firegen for Cisco ASA (getting error on all summary page dashboards)
Cisco Firepower App for Splunk (getting error on all default dashboards)
@eliasit - Did you check under Seetings->lookup->automatic lookup. Is the lookup present there , probably the permissions are not correct, that is why you are seeing the error.
Sorry this reply is a week late. I didn't get a notification about your reply.
There are no automatic lookups listed.
Looking back at my reply I realize my response was incomplete.
There are no automatic lookups listed under that name (LOOKUP-app_proto).
When you create a lookup definition at splunk, you have to run a command at splunk, to refresh the new configuration, because sometimes splunk does not recognise the new configuration. there two ways to do it
1 - run the command debug refresh, this commando will make splunk to get the new lookup definition, this happened with myself several times. I am only able to get the lookup working properly after I run this process. It does not restart the splunk service, only reload the configuration definitions.
2 - restart the splunk service
Remember that all the configuration for the lookup definitions have to be done before you run this command.
Here is a link to document about lookup files -> https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/Addfieldsfromexternaldatasources
comment converted to answer
I found the culprit, it was the Splunk Stream app.
Searching automatic lookups for "*LOOKUP-appproto" shows 10 auto lookups. Here are the first 3. The other 7 follow the same format. (stream:XXX : LOOKUP-appproto)
stream:dhcp : LOOKUP-appproto
stream:dns : LOOKUP-appproto
stream:http : LOOKUP-app_proto
Searching both "Settings->lookup->Lookup table file" and "Settings->lookup->Lookup definitions" for the same string (*LOOKUP-app_proto) returns no results.
Looking at these auto lookups, they list the "lookup definition" as streamapplookup, checking there showed "streamapplookup" was present but listed "supported fields" as none. Next, I checked the Lookup table files and found that "streamapplookup" was not present. (This should have been created when the Stream app was installed.)
Searching the splunk directory for "*applookup.csv" showed the file in Splunk\etc\apps\splunkappstream\install\SplunkTA_stream\lookups\
I created a new lookup table file using the name "streamapplookup" and the found file. I set the app as "splunkappstream" and the permissions as global.
The error has stopped.
I had the same error, but a different fix.
I had actually created a lookup with same name as an existing lookup, but with different fields. This name collision was causing the error. I changed the name of the new lookup and the errors went away.
I honestly wouldn't have found my issue if it wasn't for this thread.