Splunk Search

Why am I getting "The lookup table does not exist. It is referenced by configuration" error though I haven't used in my dashboard?

Path Finder

I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global.

What's wrong with my Splunk then?

0 Karma

SplunkTrust
SplunkTrust

Since you have blacklisted the lookups from the bundle replication, you will have to copy the lookups to the indexers manually.

You can do so by copying the app you’re searching in to the peers/indexers, or you can create a “master” lookup app with all your lookups shared globally.

0 Karma

Esteemed Legend

The problem is almost always this:

1: You have an automatic lookup defined: settings -> lookups -> automatic lookups
2: This lookup references a lookup definition that is also defined: settings -> lookups -> lookup definitions
3: This references a lookup file THAT NO LONGER EXISTS. So create it: settings -> lookups -> lookup files

Or disable the automatic lookup.

0 Karma

Splunk Employee
Splunk Employee

Is the lookup table blacklisted in the search bundle?
If the knowledge object does not exist in the bundle this can occur.

Path Finder

I did blacklist the Lookup from the bundle and suddenly I am seeing the errors for lookup axz.csv does not exist for all of my searches, How can I avoid these errors from my searches still keeping the lookup blacklisted from the bundle.

Any ideas on this will be helpful.

0 Karma

Splunk Employee
Splunk Employee

Also validate the props that the config is referencing. I have seen the input be incorrect.

0 Karma

SplunkTrust
SplunkTrust

You have created an automatic lookup that is referencing a lookup that doesn’t exist.

Go to settings > lookups > automatic lookups

Search for XXX where XXX is the lookup name that is appearing in error message. Find the auto lookup that is causing the issue and disable / delete it.

0 Karma

SplunkTrust
SplunkTrust

Hi @Naren26,

for us to help you we need some more information.

Maybe post your search in here you are trying to execute. Or a screenshot or something.

0 Karma

Path Finder

@pyro_wood even if I search for everything using "*" I am getting the error.

0 Karma

SplunkTrust
SplunkTrust

As I said, you need to provide us with more information, otherwise we won't be able to help you.
That information with "*" isn't helpful at all.

0 Karma

Path Finder

@pyro_wood even if I give just a "*" in the search query I am getting the error. The error is being thrown in all the dashboards. I believe the error is not query-specific.

I hope you understand.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!