We are using Splunk version 6.3 and facing an issue with a lookup table. While running the search, it returns below errors. FYI: we have defined the lookup table on a search head.
Search:
index=sample sourcetype=data referer="https://example.com/" | lookup user_agents user_agent | chart count by ua_family
Error:
[indexer 1] Script for lookup table 'user_agents' returned error code 1. Results may be incorrect.
[indexer 2] Script for lookup table 'user_agents' returned error code 1. Results may be incorrect.
Thanks,
raj
You should add local=true
to your lookup command. It indicates that loookup table is defined on searchhead:
index=sample sourcetype=data referer="https://example.com/" | lookup local=true user_agents user_agent | chart count by ua_family