Splunk Search

Splunk search error "Indexers error Could not load lookup=LOOKUP-XXXX " I cant find these LOOKUP anywhere

aamer86
Path Finder

I have created a lookup for a threat feed CSV file we are using. 
After deleting all the Lookup CSV files and removing all the peops.conf and Transforms.conf inputs for this lookup from the the deployer, CMn SHs and indexers I still see an error splunk_error.jpg

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The first thing to check would be the method used to remove the artifacts.  Did you remove and modify from the file system or did you use Splunk Web to do so?  If former, you'll also need to restart Splunk server.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...