Splunk Search

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

SplunkNinja
Path Finder

I am seeing the following alert on the Searching and Reporting App and also within the InfoSec App for Splunk.

[idx-1,idx-2,sh-2] Could not load lookup=LOOKUP-threatprotect-severity

I am not sure how to go about troubleshooting this further.  Thx.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkNinja ,

search in the lookups and in the lookup definitions the automatic lookup named "threatprotect-severity", probably it's missed or there are some missed fields, called by your searches, in the lookup definition.

Ciao.

Giuseppe

View solution in original post

SplunkNinja
Path Finder

I narrowed the issue down to an add-on and then updated to the latest version.  This fixed the problem.  Thanks for you help @gcusello and @PickleRick 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkNinja ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors :winking_face:

gcusello
SplunkTrust
SplunkTrust

Hi @SplunkNinja ,

search in the lookups and in the lookup definitions the automatic lookup named "threatprotect-severity", probably it's missed or there are some missed fields, called by your searches, in the lookup definition.

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

And check permissions. The lookup itself might be OK but you might not have permissions to use it.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...