All Apps and Add-ons

Cisco Security Suite: Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'cisco:wsa:w3c' and lookup table 'cisco_wsa_proxy_action_lookup


I have installed Cisco Security Suite app with all add-ons supported for it. However, I am getting the exception below in every report under Security Suite.

  Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'cisco:wsa:w3c' and lookup table 'cisco_wsa_proxy_action_lookup     

I also checked that CSV file is available with name cisco_wsa_proxy_action_lookup under the WSA add-on.

Please suggest how could I resolve this ?

0 Karma

Path Finder

Will Splunk ever fix this?

0 Karma



I am assuming that you are using Cisco Security Suite 3.1.1 and WSA TA 3.2.1. As part of recent changes in WSA TA 3.2.1, the lookup 'cisco_wsa_proxy_action_lookup' has changed some field names. Cisco Security Suite app has to be updated to be compatible with these changes. The next version of Cisco Security Suite will take care of it but for now, could you please try following changes in your local setup and see if it resolves this issue.

  • Remove 'cisco_wsa_proxy_action_lookup.csv' from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/lookups.
  • Remove following line from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/props.conf

LOOKUP-proxy_action = cisco_wsa_proxy_action_lookup vendor_action OUTPUT action AS proxy_action

  • Remove following lines from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/transforms.conf

filename = cisco_wsa_proxy_action_lookup.csv

  • Restart Splunk

There is one more change in WSA TA 3.2.1 which may affect WSA Dashboards in Cisco Security Suite. All eventtypes have changed to use '_' instead of '-', so you may have to change 'cisco-wsa-squid' to 'cisco_wsa_squid' and 'cisco-wsa-w3c' to 'cisco_wsa_w3c' in all searches in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf.

Let me know if you need further help.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...