topic Re: lookup table does not exist in Splunk Search

lookup table does not exist

gl0balt3kkie — Wed, 30 Sep 2020 01:30:51 GMT

I am having an issue where anyone that does a splunk search gets the following error:

The lookup table 'event_id_to_action_lookup' does not exist. It is referenced by configuration 'MSExchange:2013:MessageTracking'

I would be most obliged for any insight that anyone would be able to provide about this issue.

Thanks in advance.

Re: lookup table does not exist

jawaharas — Fri, 26 Jul 2019 06:24:37 GMT

Can you provide the Splunk search you used?
Do you have necessary access to the lookup file?

Re: lookup table does not exist

rjteh_splunk — Wed, 30 Sep 2020 01:27:23 GMT

@gl0balt3kkie, the automatic lookup file is most likely missing from your splunk server i.e. it may not be on disk anymore. Either an app search/splunk collections were not enabled again. At times the lookup file maybe removed from a splunk version/app upgrade, usually the latter, but it's best to check if it's on disk manually.

You can find where the lookup file is located by checking the lookup definition, followed by the file itself, on the UI. Simply navigate to...

UI > Settings > Lookups > Lookup definitions > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup" in the search filter and hit find.

Once you see the lookup filename, then you can navigate to...

UI > Settings > Lookups > Lookup table files > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup.csv" (if it is the same filename) in the search filter and hit find.

You will see the folder path for the lookup file.

The actual "event_id_to_action_lookup.csv" lookup file is part of the "TA-Exchange-Mailbox" app (TA-Exchange-Mailbox/lookups folder) which can be found here if you download "Splunk Add-on for Microsoft Exchange" app.

https://splunkbase.splunk.com/app/3225/

If this file is missing from your search head, you will need to import it back.

Re: lookup table does not exist

gl0balt3kkie — Wed, 31 Jul 2019 18:34:07 GMT

ok, thank you.

Re: lookup table does not exist

gl0balt3kkie — Wed, 31 Jul 2019 18:40:51 GMT

When I do a search at UI > Settings > Lookups > Lookup Definitions and ALL and ANY I get the following:
"There are no configurations of this type. Click the "New" button to create a new configuration."

Re: lookup table does not exist

rjteh_splunk — Wed, 31 Jul 2019 18:44:20 GMT

Do you have any lookup files in the "UI > Settings > Lookups > Lookup table files" section?

Re: lookup table does not exist

gl0balt3kkie — Wed, 30 Sep 2020 01:34:07 GMT

Yes, quite a few. However, I get the same message as above when I do a search for : event_id_to_action_lookup