Why am I getting error "lookup table 'dropdownsLookup' does not exist. It is referenced by configuration"?

[JakeConcur]

Incident:
ERROR LookupOperator - The lookup table 'dropdownsLookup' does not exist. It is referenced by configuration ...

...where configurations belongs to learned app.

How to solve it, please? How to create dropdownsLookup?

Thanks

[yannK]

Since 2020s the dropdown lookup moved to  ITSI content pack app

There is a content pack DA-ITSI-CP-unix-dashboards that contains an automatic lookup for some sourcetypes.

The lookup is Lookup-dropdowns, relying on a csv lookup named dropdowns.csv. And coupled with an automatic lookup named "dropdownsLookup".
The issue was that the csv lookup is not shipped with the app, but is being created/updated by a scheduled search "dropdowns_lookup_migrate"
That scheduled search was running, but failed to create the lookup because of fields names issues.
As a consequence, every time a search triggers the automatic lookup, the lookup throw an error because it does not find the csv file to load.

To address the issue :
- we ran the search "dropdowns_lookup_migrate" manually (without the append=t) to create the dropdowns lookup manually once to create the base lookup with the correct fields.

If you have no entities, the lookup has only one line with "all_hosts".
- then we waited for the search bundle to replicate to the indexers
After that, the lookup error stopped.

[rlacher1]

As @jeremiahc4 and @srioux mentioned in the comments, fixing the app scoping addressed a similar problem I had where I was receiving an ERROR LookupOperator - The lookup table... error.

Go to Settings > Lookups > Automatic Lookups and ensure that the Sharing for your automatic lookup is set to App, not Global. Prior to this I had noticed that the lookup didn't exist in my app's local.meta file either, and after I set the permissions from Global to App it appeared correctly.

[srioux]

App scoping could be a problem. If the auto-lookups exist in one app & shared Globally, where the lookup definition isn't, could cause some problems.

[jeremiahc4]

Did you add an automatic lookup called "dropdownsLookup" in a different app? Apparently even though you add a lookup in an app, other apps can see it if you define it by a common sourcetype. At least that is my experience at the moment. I asked a similar question recently.

http://answers.splunk.com/answers/148810/why-other-apps-are-calling-a-lookup-that-is-not-globally-sh...