I got this explanation from Splunk Support:
"Those lookups are related to Hostmon inputs. If you're not using the hostmon inputs on your windows forwarders, then these won't be populated. If you like, and you're not using hostmon, you can put in some headers and it will stop complaining about the lookups. Just edit the files, and put "a,b,c" in the top line of each one. Splunk should stop complaining about them then. Now, if you are using hostmon, then there could be an issue there. "
... View more