Error message "Could not load lookup=

Available Languages

Updated:September 29, 2026
Document ID:SPLK047843

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Consistently, after an app is upgraded the following error message starts for every search:

Could not load lookup=<lookup_name>

Investigation

This error is due to many different reasons, however, if it happens following an app upgrade it could be related to the following behavior in Splunk Cloud Classic experience:

When an app is upgraded on a single search head, by default Splunk Cloud platform excludes all lookup file updates. 
In this case, all updates to lookup files are ignored and no lookup files are added or removed.

 


Resolution

When upgrading an app that contains updated lookups on a single search head, the following workaround can be used to update the lookup files:
Download the Splunk App from Splunkbase and verify the new lookup files.
Use the Splunk App for Lookup File Editing to upload the updated lookup file.

 

More information and different scenarios can be found in the link below:
Lookup file behavior during app upgrade on Classic Experience


Manage apps on your Splunk Cloud Platform deployment

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products