ERROR: "Could not load lookup=LOOKUP-".

Applicability

Description

After upgrading apps in your Splunk deployment the titled error is reported for every search, and repeated per indexer.

6 errors occurred while the search was executing. Therefore, search results might be incomplete.
Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>
[idx-i-xxx.xyz.splunkcloud.com] Could not load lookup=LOOKUP-<lookup_name_here>

At first glance, it would appear that the lookup is missing, or there may be a permissions issue.

NOTE: For this example; the lookup in question is named "iis_action_lookup" present in the Splunk_TA_microsoft-iis app.

However, this error can be seen for different lookups belonging to other apps that have been upgraded recently.
The same steps can be followed,  by changing the lookup and app name.

Investigation

For any search that generates such errors, check the search.log via the Job Inspector:

ERROR AutoLookupDriver [2947 searchOrchestrator] - Could not load 
lookup='LOOKUP-iis_action_lookup' reason='Error in 'lookup' command: Cannot find the source 
field 'iis_status' in the lookup table 'iis_action_lookup'.'ERROR LookupDataProvider [2947 searchOrchestrator] - Cannot find the 
source field 'iis_status' in the lookup table 'iis_action_lookup'.ERROR AutoLookupDriver [2947 searchOrchestrator] - Could not load 
lookup='LOOKUP-iis_action_lookup' reason='Error in 'lookup' command: Cannot find the source 
field 'iis_status' in the lookup table 'iis_action_lookup'.'ERROR LookupDataProvider [2947 searchOrchestrator] - Cannot find the 
source field 'iis_status' in the lookup table 'iis_action_lookup'.ERROR AutoLookupDriver [2947 searchOrchestrator] - Could not load 
lookup='LOOKUP-iis_action_lookup' reason='Error in 'lookup' command: Cannot find the source 
field 'iis_status' in the lookup table 'iis_action_lookup'.'ERROR LookupDataProvider [2947 searchOrchestrator] - Cannot find the 
source field 'iis_status' in the lookup table 'iis_action_lookup'.

This tells us that there is a mismatch between the fields that the "iis_action_lookup" lookup contains, and what is expected, namely; iis_status.
 

Resolution

Checking the contents of the  ~/etc/apps/Splunk_TA_microsoft-iis/lookups/iis_action_lookup.csv file on the Search Head:

status,action
100,allowed
101,allowed

Which is the content of the original  Splunk_TA_microsoft-iis lookup file.

Version v1.2.0  of the lookup file contains: # head 5

iis_status,status_description
100.0,Continue
101.0,Switching protocols
200.0,OK. The client request has succeeded
201.0,Created

To remediate the errors replace the existing ~/etc/apps/Splunk_TA_microsoft-iis/lookups/iis_action_lookup.csv  file with the new updated v1.2.0 version.

Note: This fix applies to any other app or add-on that presents the same problem after an upgrade. It can also be provoked by a Splunk version upgrade.

Related Links

Splunkbase:
Splunk Add-on for Microsoft IIS

Splunk Documentation:
Lookups for the Splunk Add-on for Microsoft IIS

Resolving Lookup Errors - Cloud Infrastructure and Operations - Confluence