Cisco - lookup table does not exist

[ttchorz]

In my Cisco Security Suite I am getting a red exclamation mark next to all of my dashboards/reports:

The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:asa'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:fwsm'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'cisco:pix'. The lookup table 'cisco_asa_intrusion_severity_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::xxx.xxx.xxx.xxx|cisco:asa'

Also, when doing a search - I get these additional errors:
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:asa'.
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:fwsm'.
The lookup table 'cisco_asa_intrusion_vendor_severity_lookup' does not exist. It is referenced by configuration 'cisco:pix'.

I am not sure what happened. Yesterday, I tried to update Splunk_TA_cisco-asa 3.2.3 to 3.2.4 but it failed and did not run. I also created a new dashboard and placed it under Network Security tab. Not sure if any of these could have caused this issue.

[mikaelbje · Accepted solution]

When you get the 500 error when updating an app via the web GUI you usually have to delete the app's directory and reinstall it. If reinstalling via the browser doesn't work then you'll have to unpack the new version in the apps dir. I find that updating via the web often fails to update lookup files, causing undesirable results.

There's unfortunately no concept of default/ and local/ for lookups

[ttchorz]

That fixed the issue. I reinstalled the addon from web GUI as an install from a local file.
Thanks!

[wahmad_splunk]

Can you please provide more details on what occurred when you updated Splunk_TA_cisco-asa? when you say "it failed", do you mean the update failed ? any other observations?

If you have ssh access to your Splunk instance, I suggest you check the integrity of $SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/ directory content

The lookup definition 'cisco_asa_intrusion_severity_lookup' is still be part of this latest TA version.

[ttchorz]

Hi wahmad,
The error that I see is "An error occurred while installing the app: 500"

$SPLUNK_HOME/etc/apps/Splunk_TA_cisco-asa/ directory content is:
appserver
default
default.old.20151022-151425
default.old.20151022-151436
default.old.20151022-151444
default.old.20151022-115521
lookups
metadata
samples
static
license-eula.rtf
license-eula.txt
README.txt

'cisco_asa_intrusion_severity_lookup' is not present under lookups