Splunk Search

Why am I getting lookup search error "[server x] Script for lookup table 'user_agents' returned error code 1. Results may be incorrect"?

cdcproject
New Member

We are using Splunk version 6.3 and facing an issue with a lookup table. While running the search, it returns below errors. FYI: we have defined the lookup table on a search head.

Search:

index=sample sourcetype=data referer="https://example.com/" | lookup user_agents user_agent | chart count by ua_family

Error:

[indexer 1] Script for lookup table 'user_agents' returned error code 1. Results may be incorrect.
[indexer 2] Script for lookup table 'user_agents' returned error code 1. Results may be incorrect.

Thanks,
raj

0 Karma

marhuc
Explorer

You should add local=true to your lookup command. It indicates that loookup table is defined on searchhead:

index=sample sourcetype=data referer="https://example.com/" | lookup local=true user_agents user_agent | chart count by ua_family
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...