topic Re: Why are there errors when resolving missing lookup tables/fields? in Splunk Search

Why are there errors when resolving missing lookup tables/fields?

afolabia — Tue, 30 Apr 2019 19:39:55 GMT

I'm having errors resolving several missing lookup tables. Any help to resolve these will be appreciated.

The lookup table 'xmlsecurity_eventcode_errorcode_action_lookup' does not exist. It is referenced by configuration 'source::XmlWinEventLog:Security'

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WMI:WinEventLog:Security' and lookup table 'windows_app_lookup'

The lookup table 'windows_severity_lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:System'

Thanks

Re: Why are there errors when resolving missing lookup tables/fields?

lakshman239 — Wed, 01 May 2019 12:25:09 GMT

Looks like your install/upgrade of Splunk add-on for windows didn't go through fine. Pls re-install/upgrade again and use version 5.x or 6.x [ has major changes]

Re: Why are there errors when resolving missing lookup tables/fields?

bullbo — Tue, 03 Dec 2019 18:34:04 GMT

Reloaded Splunk add-on for Windows (v7.0) and still get the same errors. Anything else it could be?