ERROR: Could not load lookup=LOOKUP-

Applicability

Description

When running searches in the Splunk Cloud UI, users may see the following lookup-related error messages:

Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx

These errors indicate that the system is unable to load the specified lookup tables during search execution.

Investigation

1.Run the search on index=_internal and observe the errors: 

Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx
Could not load lookup=LOOKUP-xxxxx 

2. Reviewed Job > Inspect Job > search.log and observed the following entries:- 

Could not load lookup='LOOKUP-xxxxx' reason='Error in 'lookup' command: Cannot find the destination field 'severity' in the lookup table 'xxxxx'.'Cannot find the destination field 'severity' in the lookup table 'xxxxx'.Cannot find the destination field 'severity' in the lookup table 'xxxxx'.Cannot find the destination field 'severity' in the lookup table 'xxxxx'.

3.This Investigation identified that the root cause was a mismatch between the output fields defined in Settings > Lookups > Automatic Lookups and the fields available in the corresponding Lookup Definitions. Specifically, the 'severity' field was configured as an output field but did not exist in the associated lookup definitions, resulting in the lookup errors. 

Resolution

To resolve the issue, remove the 'severity' field from the list of output fields in Settings > Lookups > Lookup Definitions for the affected lookups. This adjustment will prevent the lookup errors from occurring during searches.