All Apps and Add-ons

Cisco - lookup table does not exist

ttchorz
Path Finder

In my Cisco Security Suite I am getting a red exclamation mark next to all of my dashboards/reports:

The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:asa'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:fwsm'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:pix'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::xxx.xxx.xxx.xxx|cisco:asa'

Also, when doing a search - I get these additional errors:
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:asa'.
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:fwsm'.
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:pix'.

I am not sure what happened. Yesterday, I tried to update Splunk_TA_cisco-asa 3.2.3 to 3.2.4 but it failed and did not run. I also created a new dashboard and placed it under Network Security tab. Not sure if any of these could have caused this issue.

0 Karma
1 Solution

mikaelbje
Motivator

When you get the 500 error when updating an app via the web GUI you usually have to delete the app's directory and reinstall it. If reinstalling via the browser doesn't work then you'll have to unpack the new version in the apps dir. I find that updating via the web often fails to update lookup files, causing undesirable results.

There's unfortunately no concept of default/ and local/ for lookups

View solution in original post

mikaelbje
Motivator

When you get the 500 error when updating an app via the web GUI you usually have to delete the app's directory and reinstall it. If reinstalling via the browser doesn't work then you'll have to unpack the new version in the apps dir. I find that updating via the web often fails to update lookup files, causing undesirable results.

There's unfortunately no concept of default/ and local/ for lookups

ttchorz
Path Finder

That fixed the issue. I reinstalled the addon from web GUI as an install from a local file.
Thanks!

0 Karma

wahmad_splunk
Splunk Employee
Splunk Employee

Can you please provide more details on what occurred when you updated Splunk_TA_cisco-asa? when you say "it failed", do you mean the update failed ? any other observations?

If you have ssh access to your Splunk instance, I suggest you check the integrity of $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/ directory content

The lookup definition 'cisco_asa_intrusion_severity_lookup' is still be part of this latest TA version.

0 Karma

ttchorz
Path Finder

Hi wahmad,
The error that I see is "An error occurred while installing the app: 500"

$SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/ directory content is:
appserver
default
default.old.20151022-151425
default.old.20151022-151436
default.old.20151022-151444
default.old.20151022-115521
lookups
metadata
samples
static
license-eula.rtf
license-eula.txt
README.txt

'cisco_asa_intrusion_severity_lookup' is not present under lookups

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...