Splunk Search

Second Indexer/SearchPeer reports "The lookup table '{LOOKUP_TABLE}' does not exist. It is referenced by configuration '{APP}." but it does. What is causing this message?

rgcurry
Contributor

I have defined a lookup table for one of my Apps and it is working perfectly. But if I go to a different App and issue a search, I get the error message "The lookup table '{LOOKUP_TABLE}' does not exist. It is referenced by configuration '{APP}." I have checked and the permissions on the lookup table are set to 'APP'.

I have also reviewed many of the previously asked questions on this site and none of the answers seem to fit my situation, or at least provide no resolution to this situation for me. I have looked at:

What else do I need to look at in my system to resolve this "problem"?

Tags (2)
1 Solution

lguinn2
Legend

Lookups have permissions, just like other knowledge objects. Both the lookup file AND the lookup definition have permissions, in fact.

Edit permissions for both of these to make them available globally. I think that will solve your problem. At the moment, your lookup belongs to a single app and is visible only to that app. (Or maybe your lookup is global but the lookup file belongs to a single app.)

BTW, you must have Splunk admin role to assign global permissions. Otherwise, you can only share within a single app.

View solution in original post

coleman07
Path Finder

This is the most odd behavior and most counter intuitive thing I have seen. I had the opposite problem. I wanted to share my props and transform for a lookup for a different app so I set both the file and the automatic lookup to global and it didn't work. I set the automatic lookup to app and it works fine now. Why it wouldn't work with global makes no sense to me.

0 Karma

lguinn2
Legend

Lookups have permissions, just like other knowledge objects. Both the lookup file AND the lookup definition have permissions, in fact.

Edit permissions for both of these to make them available globally. I think that will solve your problem. At the moment, your lookup belongs to a single app and is visible only to that app. (Or maybe your lookup is global but the lookup file belongs to a single app.)

BTW, you must have Splunk admin role to assign global permissions. Otherwise, you can only share within a single app.

lguinn2
Legend

My guess is that you set up an automatic lookup for a source or sourcetype. Now Splunk wants to run the lookup even when you are working in a different App.

I understand your thinking "I defined the lookup in an App. It should only run the lookup when I am using that App." That makes sense to me, but I don't think that is how it works.

Or maybe there is a more complicated reason that I just can't see.

rgcurry
Contributor

I get that resolves this issue. What I am not clear on is how it is I must do this when the data in the lookup table is specific to this App and irrelevant to the others. Do you have 'inside' info on how this needs to be this way? Curious minds want to know! (8->)

BTW -- Thanks for your time and excellent assistance on this.

0 Karma

lguinn2
Legend

Yep, just update them to global and you should be good to go!

rgcurry
Contributor

I have checked and verified all three permissions for the table and confirmed they are set to "App". I do confess that I did that as I was entering this post but continued with it and submitted it after confirming. Great thought and a logical one at that, thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...