Why am I getting "The lookup table does not exist. It is referenced by configuration" error though I haven't used in my dashboard?

[Naren26]

I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global.

What's wrong with my Splunk then?

[jkat54]

Since you have blacklisted the lookups from the bundle replication, you will have to copy the lookups to the indexers manually.

You can do so by copying the app you’re searching in to the peers/indexers, or you can create a “master” lookup app with all your lookups shared globally.

[woodcock]

The problem is almost always this:

1: You have an automatic lookup defined: settings -> lookups -> automatic lookups
2: This lookup references a lookup definition that is also defined: settings -> lookups -> lookup definitions
3: This references a lookup file THAT NO LONGER EXISTS. So create it: settings -> lookups -> lookup files

Or disable the automatic lookup.

[jneighbors_splu]

Is the lookup table blacklisted in the search bundle?
If the knowledge object does not exist in the bundle this can occur.

[arrangineni]

I did blacklist the Lookup from the bundle and suddenly I am seeing the errors for lookup axz.csv does not exist for all of my searches, How can I avoid these errors from my searches still keeping the lookup blacklisted from the bundle.

Any ideas on this will be helpful.

[jneighbors_splu]

Also validate the props that the config is referencing. I have seen the input be incorrect.

[jkat54]

You have created an automatic lookup that is referencing a lookup that doesn’t exist.

Go to settings > lookups > automatic lookups

Search for XXX where XXX is the lookup name that is appearing in error message. Find the auto lookup that is causing the issue and disable / delete it.

[horsefez]

Hi @Naren26,

for us to help you we need some more information.

Maybe post your search in here you are trying to execute. Or a screenshot or something.

[Naren26]

@pyro_wood even if I search for everything using "*" I am getting the error.

[horsefez]

As I said, you need to provide us with more information, otherwise we won't be able to help you.
That information with "*" isn't helpful at all.

[Naren26]

@pyro_wood even if I give just a "*" in the search query I am getting the error. The error is being thrown in all the dashboards. I believe the error is not query-specific.

I hope you understand.