ERROR: "Could not load lookup=LOOKUP-" due to replication issue in automatic lookup

Applicability

Splunk Enterprise Splunk Cloud

Description

These error message pops up for several reasons.
Most of them have solutions with removing the automatic lookup in $SPLUNKHOME/etc/apps/**/props.conf or removing app including the automatic lookup.
However, for this case, the root cause of the error message is the collection wasn't replicated.

 

Investigation

Lookup has three configurations:

• Lookup table files.
• Lookup definitions.
• Automatic lookups.

The lookup using KVStore would have 'Lookup definitions' and 'Automatic lookups'.
Instead of using lookup table files, it will have a collection configuration in $SPLUNKHOME/etc/apps/appname/local/collections.conf.
  
Some lookup may not have Automatic lookups and in this case, have to use 'lookup' command at search query. If automatic lookup is not configured, the issue will not happen.
  
Example of configuration
  
Collection is configured in $SPLUNK_HOME/etc/apps/appname/local/collections.conf and corresponding db file will be created in ./kvstore/mongo directory.

.../collections.conf
       [my_collection_lookup]
    
    .../var/lib/splunk/kvstore/mongo
        s_my_TA_wkcYrzDwikVc7AFZcOyOh8BV_my_colajG3I1cPP+EMSFpmW8i2Yk6g.0
        s_my_TA_wkcYrzDwikVc7AFZcOyOh8BV_my_colajG3I1cPP+EMSFpmW8i2Yk6g.ns

   
Lookup definitions is configured in $SPLUNK_HOME/etc/system/local/transforms.conf.

.../transforms.conf
      [my_lookup_team]
      collection = my_collection_lookup
      external_type = kvstore
      fields_list = kv_key, name, team, phone

Automatic lookup is configured in $SPLUNK_HOME/etc/system/local/props.conf

.../props.conf
      [my_st_lookup]
      LOOKUP-my_lookup_team_auto = my_lookup_team kv_key AS key OUTPUTNEW kv_key 
      AS key name AS name phone AS phone team AS team

As default, the collection, in this example my_collection_lookup, is disabled the replication.
  

[my_collection_lookup]
      profilingEnabled = false
      profilingThresholdMs = 1000
      replicate = false            <<<----------------------------- 
      replication_dump_maximum_file_size = 10240
      replication_dump_strategy = auto
      type = undefined

Thus, the search cannot use the collection which is lookup table on indexer and throws the error message.
  

 

Resolution

Solution is as simple as just enable the replication of the collection in $SPLUNK_HOME/etc/apps/appname/local/collections.conf

.../collections.conf
    [my_collection_lookup]
    replicate = true

 

When the collection is enabled, that collection will be included in the Knowledge bundle and replicated to indexers.

The db file name is used for the directory in the bundle and that will have the table 00000000.csv.
 

ls -l ./var/run/searchpeers/st02sh01-1585882798total 8
drwx------  2 st02idx2 st02idx2    6 Apr  3 03:00 alive_tokens
drwx------ 21 st02idx2 st02idx2 4096 Apr  3 02:48 apps
-rw-------  1 st02idx2 st02idx2   70 Apr  3 02:49 bundle.info
drwx------  2 st02idx2 st02idx2   26 Apr  3 02:48 kvstore_s_my_TA_wkcYrzDwikVc7AFZcOyOh8BV_my_colajG3I1cPP+EMSFpmW8i2Yk6g
drwx------  6 st02idx2 st02idx2   63 Apr  3 02:48 system
drwx------  3 st02idx2 st02idx2   19 Apr  3 02:48 users

 

Related Links

LookupOverview
LookupConfiguration
TroubleshoottheSplunkAppforWindowsInfrastructure

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release