I haven't used any lookup table in my dashboard. But still I am facing "The lookup table XXX does not exist. It is referenced by configuration YYY" error. I have checked the permission settings of XXX in Lookup definitions, Automatic lookup, Lookup table files & Configuration settings of YYY. Each one is been set as Global.
What's wrong with my Splunk then?
Since you have blacklisted the lookups from the bundle replication, you will have to copy the lookups to the indexers manually.
You can do so by copying the app you’re searching in to the peers/indexers, or you can create a “master” lookup app with all your lookups shared globally.
The problem is almost always this:
1: You have an
automatic lookup defined:
2: This lookup references a
lookup definition that is also defined:
3: This references a lookup file THAT NO LONGER EXISTS. So create it:
Or disable the automatic lookup.
I did blacklist the Lookup from the bundle and suddenly I am seeing the errors for lookup axz.csv does not exist for all of my searches, How can I avoid these errors from my searches still keeping the lookup blacklisted from the bundle.
Any ideas on this will be helpful.
You have created an automatic lookup that is referencing a lookup that doesn’t exist.
Go to settings > lookups > automatic lookups
Search for XXX where XXX is the lookup name that is appearing in error message. Find the auto lookup that is causing the issue and disable / delete it.
@pyro_wood even if I give just a "*" in the search query I am getting the error. The error is being thrown in all the dashboards. I believe the error is not query-specific.
I hope you understand.