@gl0balt3kkie, the automatic lookup file is most likely missing from your splunk server i.e. it may not be on disk anymore. Either an app search/splunk collections were not enabled again. At times the lookup file maybe removed from a splunk version/app upgrade, usually the latter, but it's best to check if it's on disk manually.
You can find where the lookup file is located by checking the lookup definition, followed by the file itself, on the UI. Simply navigate to...
UI > Settings > Lookups > Lookup definitions > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup" in the search filter and hit find.
Once you see the lookup filename, then you can navigate to...
UI > Settings > Lookups > Lookup table files > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup.csv" (if it is the same filename) in the search filter and hit find.
You will see the folder path for the lookup file.
The actual "event_id_to_action_lookup.csv" lookup file is part of the "TA-Exchange-Mailbox" app (TA-Exchange-Mailbox/lookups folder) which can be found here if you download "Splunk Add-on for Microsoft Exchange" app.
https://splunkbase.splunk.com/app/3225/
If this file is missing from your search head, you will need to import it back.
