topic Re: The lookup table '...' does not exist in Splunk Search

The lookup table '...' does not exist

marco_stiegeman — Mon, 28 Sep 2020 15:02:41 GMT

After installing the Windows App 5.0.2 on our splunk 5.0.3 i get these errors when doing a search:

The lookup table 'wmi_version_range_lookup' does not exist. It is referenced by configuration 'WMI:Version'.

The lookup table 'msdhcp_signature_lookup' does not exist. It is referenced by configuration 'DhcpSrvLog'.

I found this thread splunk answers but this didn't help ...

Re: The lookup table '...' does not exist

dprows — Tue, 29 Oct 2013 11:58:42 GMT

I have the same issue and the thread listed didn't help me either.

Re: The lookup table '...' does not exist

ShaneNewman — Tue, 03 Dec 2013 02:48:50 GMT

I had to rerun the lookup search to create the lookup file manually after this. Once I did that, everything started working fine!

Re: The lookup table '...' does not exist

aelliott — Thu, 05 Dec 2013 21:28:51 GMT

So I found that lookup tables are very picky. If they exist at an app level, they are only available for that app, no matter the permissions.
If you replace a lookup table, you must open the definition and automation and re-save them
One way to make them "less" picky is to put them at the system level, this makes them available in all apps. .. more info on that here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

If you need to package the app, i found it necessary to add the lookup file/definition/automation to each app.