All Apps and Add-ons

Cisco Security Suite: Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'cisco:wsa:w3c' and lookup table 'cisco_wsa_proxy_action_lookup


I have installed Cisco Security Suite app with all add-ons supported for it. However, I am getting the exception below in every report under Security Suite.

  Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'cisco:wsa:w3c' and lookup table 'cisco_wsa_proxy_action_lookup     

I also checked that CSV file is available with name cisco_wsa_proxy_action_lookup under the WSA add-on.

Please suggest how could I resolve this ?

0 Karma

Path Finder

Will Splunk ever fix this?

0 Karma



I am assuming that you are using Cisco Security Suite 3.1.1 and WSA TA 3.2.1. As part of recent changes in WSA TA 3.2.1, the lookup 'cisco_wsa_proxy_action_lookup' has changed some field names. Cisco Security Suite app has to be updated to be compatible with these changes. The next version of Cisco Security Suite will take care of it but for now, could you please try following changes in your local setup and see if it resolves this issue.

  • Remove 'cisco_wsa_proxy_action_lookup.csv' from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/lookups.
  • Remove following line from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/props.conf

LOOKUP-proxy_action = cisco_wsa_proxy_action_lookup vendor_action OUTPUT action AS proxy_action

  • Remove following lines from /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/transforms.conf

filename = cisco_wsa_proxy_action_lookup.csv

  • Restart Splunk

There is one more change in WSA TA 3.2.1 which may affect WSA Dashboards in Cisco Security Suite. All eventtypes have changed to use '_' instead of '-', so you may have to change 'cisco-wsa-squid' to 'cisco_wsa_squid' and 'cisco-wsa-w3c' to 'cisco_wsa_w3c' in all searches in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf.

Let me know if you need further help.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...