Splunk Search

Splunk search error "Indexers error Could not load lookup=LOOKUP-XXXX " I cant find these LOOKUP anywhere

aamer86
Path Finder

I have created a lookup for a threat feed CSV file we are using. 
After deleting all the Lookup CSV files and removing all the peops.conf and Transforms.conf inputs for this lookup from the the deployer, CMn SHs and indexers I still see an error splunk_error.jpg

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The first thing to check would be the method used to remove the artifacts.  Did you remove and modify from the file system or did you use Splunk Web to do so?  If former, you'll also need to restart Splunk server.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...