The lookup table '...' does not exist or is not available.

[khsewell]

Hi!,

This is a contrived example, but could you help me understand why this completes (and functions as expected):

| makeresults format=csv data="filename
calc.exe" | lookup isWindowsSystemFile_lookup filename

Whilst this:

index=sandbox | eval filename="calc.exe" | lookup isWindowsSystemFile_lookup filename

throws an error with message:

... The lookup table 'isWindowsSystemFile_lookup' does not exist or is not available.

The isWindowsSystemFile_lookup is provided by Splunk Security Essentials.

Hmm, I'm on splunk cloud.

Thanks,

Kevin

[khsewell · Accepted solution]

Thanks,
That made me dig in the right place, leading to ...
https://splunk.my.site.com/customer/s/article/User-is-getting-an-error-message-when 

Essentially,
... it was found that all the lookups present in the app “Splunk_Security_Essentials” are added in denylist by default.

Resolution to the error is to add local=true at the end of SPL command as below:
... | lookup isWindowsSystemFile_lookup filename local=true

The indexers need a read-only copy of the knowledge bundle in order to run searches. Splunk Security Essentials brings a significant amount of data that does not need to be copied to the search heads. Adding "local=true", forces the lookup to run on the search head and not on any remote peer.

That's ok for my purposes I think.

[richgalloway]

The first example runs entirely on the Search Head where the lookup definition is available.

The second example runs on the indexers, which apparently is unaware of the lookup definition.  Either the app defining the lookup is not installed on the indexers or the lookup file is blocked from the knowledge bundle ([replicationDenyList] in distsearch.conf).