Lookup Can't Find File

[hartfoml]

I am in a clustered indexer environment and some but not all of my indexers are showing this error

"The lookup table 'org-lookup' does not exist. It is referenced by configuration 'host::*'."

How to I find the file or APP or props.conf that this look-up is referring to?

Thanks in advance for your help.

[Drainy]

Or an even easier Splunk-centric way to find this would be to run from the $SPLUNK_HOME/bin directory;

./splunk cmd btool transforms list --debug | grep org-lookup

Chances are that the lookup exists in the $SPLUNK_HOME/etc/users/ directory somewhere and it just needs to be made public (although there are plenty of other reasons).

It looks like a defined lookup so you could try in Manager and lookups first, it may well be defined in the UI.

[Drainy]

btool is one of the most useful commands when troubleshooting Splunk, the --debug flag prepends the app that the config stanza is from to the line. You can run it without and it just won't show you the app context. The most powerful part of btool is that it shows you the applied configuration of all config files

[mbenwell]

btool. I had no idea that existed. Thanks

The lookup location is interesting, I dont have any lookups in $SPLUNK_HOME/etc/users . When I've created lookup files via GUI, I dont specify a filesystem path, just filename and Splunk always seems to put it in the app/looklups directory

[mbenwell]

You should find the reference to the lookup file in transforms.conf. The lookup file itself would typically be in $SPLUNK_HOME/etc/apps//lookups

If on linux the easiest way to find which transforms.conf file that it contains the lookup configuration is to do something like this from the command line:
for i in `locate transforms.conf`; do grep -i5H 'org-lookup' $i; done

The above assumes you have locate installed and up to date.

You should be able to do something similar in Windows