Splunk Search

Splunk search error "Indexers error Could not load lookup=LOOKUP-XXXX " I cant find these LOOKUP anywhere

aamer86
Path Finder

I have created a lookup for a threat feed CSV file we are using. 
After deleting all the Lookup CSV files and removing all the peops.conf and Transforms.conf inputs for this lookup from the the deployer, CMn SHs and indexers I still see an error splunk_error.jpg

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The first thing to check would be the method used to remove the artifacts.  Did you remove and modify from the file system or did you use Splunk Web to do so?  If former, you'll also need to restart Splunk server.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...