Since 2020s the dropdown lookup moved to ITSI content pack app
There is a content pack DA-ITSI-CP-unix-dashboards that contains an automatic lookup for some sourcetypes.
The lookup is Lookup-dropdowns, relying on a csv lookup named dropdowns.csv. And coupled with an automatic lookup named "dropdownsLookup".
The issue was that the csv lookup is not shipped with the app, but is being created/updated by a scheduled search "dropdowns_lookup_migrate"
That scheduled search was running, but failed to create the lookup because of fields names issues.
As a consequence, every time a search triggers the automatic lookup, the lookup throw an error because it does not find the csv file to load.
To address the issue :
- we ran the search "dropdowns_lookup_migrate" manually (without the append=t) to create the dropdowns lookup manually once to create the base lookup with the correct fields.
If you have no entities, the lookup has only one line with "all_hosts".
- then we waited for the search bundle to replicate to the indexers
After that, the lookup error stopped.
As @jeremiahc4 and @srioux mentioned in the comments, fixing the app scoping addressed a similar problem I had where I was receiving an
ERROR LookupOperator - The lookup table... error.
Settings > Lookups > Automatic Lookups and ensure that the Sharing for your automatic lookup is set to App, not Global. Prior to this I had noticed that the lookup didn't exist in my app's
local.meta file either, and after I set the permissions from Global to App it appeared correctly.
Did you add an automatic lookup called "dropdownsLookup" in a different app? Apparently even though you add a lookup in an app, other apps can see it if you define it by a common sourcetype. At least that is my experience at the moment. I asked a similar question recently.