Splunk Search

Lookup Errors When No Lookup Is Used

lodolivas
Engager

I'm getting "Could not find all of the specified lookup fields in the lookup table......." even when I'm not using a lookup. It references a particular lookup table that I do use in some searches but those searches complete just fine and the lookup returns values along with the error. The automatic lookup is configured for a particular sourcetype but I also get the error when searching other sourcetypes. I've tried remove the entire config for the lookup and the auto config and re-created it but the error persists. Any thoughts?

Tags (2)

Kenshiro70
Path Finder

I've had this too. From what I can tell, it's a permissions issue with Lookup definitions. Do not set Lookup definition permissions to Global. What happens is that in other apps the query looks for the definition within the app, even thought it's global. You can have the Lookup file at Global, but you have the create a Lookup definition within the app you want to use it and set the permission to App.

0 Karma

linu1988
Champion

It happens when the lookup definition is itself incorrect. Please check the lookup definition again.

0 Karma

dbourg_splunk
Splunk Employee
Splunk Employee

I've seen this before, and it usually occurs when there is a conflict with permissions, as well as what is in the configs themselves. Try deleting (or commenting out) anything in your props and transforms, then double check what may still exist via the GUI. Following that, you can re-enable your lookups and alter their permissions.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...