Applicability
Splunk Cloud
Splunk Enterprise
Description
Investigation
- Confirm if adding the missing lookup files (for example
lookup_1 and lookup_2) to the relevant application's lookup directory resolves the issue.
- If the issue persists, validate that users with the
admin role can execute searches without encountering the lookup errors.
- Verify whether the error is specific to users with a particular role (e.g.,
O365 role).
- If only users with this role see the error on every search, this indicates a permissions issue rather than a problem with a specific search or application.

- Based on these steps, the investigation should conclude that the issue is caused by incorrect permissions on the lookup files for the affected user role.
- If the issue is not with specific role, please verify if there is a field mismatch in lookup file.
-
For instance, the field values in the file - lookup_1.csv are iis_status,status_description . But in CLI (local/props.conf) it is using the fields status, action .
- In some cases, the lookup definition could be the same among different apps for same automatic lookup due to which issue occurs.
Resolution
- Follow these steps to resolve the lookup error by correcting its permissions:
- Navigate to Settings > Lookups > Automatic lookups.
- In the filter bar, set the App context dropdown to All.
- Search for the lookup table mentioned in the error message.
- For the problematic lookup, click Permissions and change the sharing setting from Global to This app only.
- Save the changes. It may take a few moments for the new permissions to take effect.
- To validate the fix, have an affected user run any search in the Search & Reporting app. The lookup error should no longer appear.
- Ensure that field values match in lookup file with the one configured at backend.
Revision History
| Revision |
Publish Date |
Comments |
1.0 |
29-Sep-2026
|
Initial Release |