ERROR: "Could not load lookup=LOOKUP-" due to missing/incorrect lookup file name or upgrade issue

Applicability

Description

Searches trigger the following error message: 

6 errors occurred while the search was executing. Therefore, search results might be incomplete.
Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>

This could be due to a number of issues, but the most common is that the lookup name cannot be found or some contents of the lookup file is missing.
This will need to be removed or commented out or updated since Splunk software processes lookups after it processes field extractions, field aliases, and calculated fields. 

Investigation

Any search receives the following message in Search Head UI

Error: Could not load lookup=Name of Lookup 

In this scenario, the error message displayed the hosts were on the indexing tier. Example below: 

Could not load lookup=Name of Lookup
host = idx-i-<hostname>.<stackid>.splunkcloud.com source = /opt/splunk/var/log/splunk/search_messages.log

After running a btool command  as below the lookup reference was found in .
 $SPLUNKHOME/etc/apps/***/props.conf 

 

./$SPLUNKHOME/bin/splunk btool props list --debug

This issue can be fixed by removing this lookup or updating the lookup file with right file name/table name from $SPLUNKHOME/etc/apps/***/props.conf . 

Resolution

Review $SPLUNK_HOME/etc/app/*/props.conf to confirm if the lookup in question is available.

$SPLUNK_HOME/etc/app/*/props.conf

If that lookup is still exist,  it will be queried internally by Splunk software. 
The setting will need to be disabled, removed or commented out since Splunk software processes lookups after it processes field extractions, field aliases, and calculated fields.

If the issue is due to app upgrade, Please check over the respective lookup file contents and update it 
 

Related Links