ERROR: "Could not load lookup=LOOKUP-" due to missing permission for lookup file

Applicability

Description

6 errors occurred while the search was executing. Therefore, search results might be incomplete. Could not load lookup=LOOKUP-<lookup_name_here> [idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here> [idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here> [idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here> [idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here> [idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>

Investigation

The issue is due to permission on lookup file:

1. Go to Lookups > Lookup table files.
2. Navigate to > App (change it to All)  > filter (lookup name).
3. Change the > Permissions > This app only > Save.
   
   

Resolution

Set the correct permission across the app: 

1. Go to Lookups > Lookup table files > 
2. Set the >App (change it to All)  > filter (lookup name)
3. Change the > Permissions > This app only > Save

If Lookup permissions are not set for everybody, ensure that the roles assigned to the users that need access to these Lookup tables have the necessary permissions checked.

1. Go to Lookups > Lookup table files
2. Set the > App (change it to All)  > filter (lookup name)
3. Change the > Permissions > Look for the roles and ensure that at least one permission is checked > Save

Related Links

LookupOverview
LookupConfiguration
TroubleshoottheSplunkAppforWindowsInfrastructure