topic Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure? in All Apps and Add-ons

Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

dlpco — Tue, 29 Sep 2020 20:07:41 GMT

After upgrading to Splunk Add-on for Microsoft Windows 5.0.0 and Splunk App for Windows Infrastructure 1.4.4 it seems I get the following errors ever query I put in:

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WMI:WinEventLog:Security' and lookup table 'windows_app_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'source::WinEventLog:Security' and lookup table 'windows_app_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'source::XmlWinEventLog:Security' and lookup table 'windows_app_lookup'.

I am unsure what the "for conf" stands for, but when I do a "|inputlookup windows_app_lookup" it does shows the file but no header is conf. It does show the 3 keys above.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

darrenfuller — Sat, 23 Jun 2018 00:01:09 GMT

Have you tried rerunning the Winfra app setup procedure? that usually clears lookup errors like that.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

bhargavnariyani — Sat, 23 Jun 2018 17:48:32 GMT

The release notes stats that Windows Infrastructure 1.4.4 and Windows Addon 5.0.0 are not compatible yet. http://docs.splunk.com/Documentation/WindowsAddOn/latest/User/Releasenotes
Hence you might be facing such errors.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

dlpco — Sat, 23 Jun 2018 23:35:56 GMT

How do I rerun the app setup? Are you talking about the setup within the Windows Infrastructure application or do you mean to delete and re-add the application?

Just doing a rebuild on the lookups did not help.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

dlpco — Sat, 23 Jun 2018 23:40:28 GMT

Also - why is it complaining when I am not displaying Windows items or using the lookup. If I simply do a search with index=main or even index=_audit, I get the same 3 errors! Why?

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

dlpco — Sun, 24 Jun 2018 00:51:02 GMT

I just saw that in the docs as well as during the application setup. Highest version can only be 4.8.4 right now.
OOPS!!! Thanks guys

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

RupeshMano — Tue, 17 Jul 2018 23:49:17 GMT

Hi Dipco,

Does downgrading your windows addon helped in fixing the issue ? even I have similar issue, so wanted to check if this solution worked.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

dlpco — Wed, 18 Jul 2018 01:56:22 GMT

Yes it did. It actually had the warning on the application setup screen if you read it. Feel a little stupid that I didn't read/see the error before I posted.

Re: Why is the Windows App Lookup giving errors in Splunk App for Windows Infrastructure?

RupeshMano — Wed, 18 Jul 2018 22:44:19 GMT

Yeah same here, I thought 4.8 version or above 🙂 thanks for the reply. I will try it.