ERROR: lookup command: Expecting lookup table name as the first argument

Available Languages

Updated:September 28, 2026
Document ID:SPLK044301

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

* Error while searching 
Could not load lookup=LOOKUP-SFDC-USER_NAME2 
[idx-i-xxxxa.[stack].splunkcloud.com] Could not load lookup=LOOKUP-SFDC-USER_NAME2 
[idx-i-xxxxb.[stack].splunkcloud.com] Could not load lookup=LOOKUP-SFDC-USER_NAME2 
[idx-i-xxxxc.[stack].splunkcloud.com] Could not load lookup=LOOKUP-SFDC-USER_NAME2

* In search.log on 'Job Inspector' 
07-31-2019 04:22:21.307 ERROR LookupProviderFactory - Expecting lookup table name as the
first argument. 07-31-2019 04:22:21.307 ERROR AutoLookupDriver - Could not load lookup='LOOKUP-SFDC-USER_NAME2'
reason='Error in 'lookup' command: Expecting lookup table name as the first argument.'

 

Investigation

If a sourcetype stanza has an empty lookup table reference, you will receive the message: Error in 'lookup' command: Expecting lookup table name as the first argument.

This might happen when a user tweaks a sourcetype in the UI and removes the lookup reference. For example, when a global lookup gets removed from one sourcetype. Splunk Web might show the successful removal of the lookup, but the empty configuration setting is still in the props.conf file.

 

Resolution

1. Find the empty lookup reference using btool on props.conf with the lookup name. For example:  
./splunk btool props list --debug |grep <lookup_name>
2. Edit the offending props.conf file.
3. Find and remove the empty lookup reference from the sourcetype stanza.
4. Test a search and confirm the error doesn't reappear.
 

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products