topic Re: Lookup table does not exist error on update to 4.1 in Getting Data In

Lookup table does not exist error on update to 4.1

Yancy — Thu, 20 May 2010 03:05:10 GMT

Since I updated our server to 4.1.2 I'm seeing the following error with most searches.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'.

I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux.

Re: Lookup table does not exist error on update to 4.1

Ledio_Ago — Thu, 20 May 2010 03:35:29 GMT

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

Re: Lookup table does not exist error on update to 4.1

Yancy — Thu, 20 May 2010 06:05:43 GMT

Thanks Ledio, that resolved the issue for me.