Lookup Errors When No Lookup Is Used

[lodolivas]

I'm getting "Could not find all of the specified lookup fields in the lookup table......." even when I'm not using a lookup. It references a particular lookup table that I do use in some searches but those searches complete just fine and the lookup returns values along with the error. The automatic lookup is configured for a particular sourcetype but I also get the error when searching other sourcetypes. I've tried remove the entire config for the lookup and the auto config and re-created it but the error persists. Any thoughts?

[Kenshiro70]

I've had this too. From what I can tell, it's a permissions issue with Lookup definitions. Do not set Lookup definition permissions to Global. What happens is that in other apps the query looks for the definition within the app, even thought it's global. You can have the Lookup file at Global, but you have the create a Lookup definition within the app you want to use it and set the permission to App.

[linu1988]

It happens when the lookup definition is itself incorrect. Please check the lookup definition again.

[dbourg_splunk]

I've seen this before, and it usually occurs when there is a conflict with permissions, as well as what is in the configs themselves. Try deleting (or commenting out) anything in your props and transforms, then double check what may still exist via the GUI. Following that, you can re-enable your lookups and alter their permissions.