Splunk Search

Could not load lookup=LOOKUP-browser ???

Jarohnimo
Builder

Hello All,

I just upgraded to the latest version of Splunk 7.2.5 and now when I search anything i recieve errors stating "Could not load lookup=LOOKUP-Browser"

I'm not sure what that is, I never used a "Lookup Browser" table or anything of the sort prior to this update so i'm not sure where the message is coming from. Can someone please point me in the direction of how to get rid of/ mute this message?

Also If you have any input on what LOOKUP-Browser is, i'd appreciate it! thanks!

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

It looks like you had Lookup definition, Lookup file or Automatic Lookup with name Browser in your splunk configuration and now splunk is not able to find that lookup file but in configuration file it is still pointing to non-existing lookup or lookup file or lookup definition permission has been changed and due to that automatic lookup is not able to find that lookup.

If you have CLI access then check lookup props and transforms configuration using btool

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

It looks like you had Lookup definition, Lookup file or Automatic Lookup with name Browser in your splunk configuration and now splunk is not able to find that lookup file but in configuration file it is still pointing to non-existing lookup or lookup file or lookup definition permission has been changed and due to that automatic lookup is not able to find that lookup.

If you have CLI access then check lookup props and transforms configuration using btool

rajasha
Explorer

Hi @harsmarvania57 @Jarohnimo @nickhills  I'm facing same problem but with multiple lookup error. Where I'm using cloud enterprise architecture then how could I able to check the same? Do I need to check in somewhere else?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

If you are using Splunk Cloud then you don't have CLI access on Splunk search heads, I guess you need to raise case with support.

Thanks,

Harshil

0 Karma

Jarohnimo
Builder

Thanks harsmarvania57, It ended up being a very old entry under my search/ props conf file that had this entry. Thanks! (I'm trying to mark your response as the answer).

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

That's great that you found the issue. I have converted my comment to answer so that you can accept it.

0 Karma

nickhills
Ultra Champion

Copy/Paste command to find the culprit:

/opt/splunk/bin/splunk btool props list --debug |grep LOOKUP-Browser

If my comment helps, please give it a thumbs up!
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...