Splunk Search

Splunk search error "Indexers error Could not load lookup=LOOKUP-XXXX " I cant find these LOOKUP anywhere

aamer86
Path Finder

I have created a lookup for a threat feed CSV file we are using. 
After deleting all the Lookup CSV files and removing all the peops.conf and Transforms.conf inputs for this lookup from the the deployer, CMn SHs and indexers I still see an error splunk_error.jpg

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The first thing to check would be the method used to remove the artifacts.  Did you remove and modify from the file system or did you use Splunk Web to do so?  If former, you'll also need to restart Splunk server.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...