Palo Alto Networks App for Splunk: How to regenerate the lookup table from disk?

[skjennings]

We are getting the following error when we run queries:
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan:newapps'.

Looks like someone deleted the lookup table in the Splunk instance but it still exists on the disk. I just do not know how to have it generate the table and definition.

Note: I tried to reinstall the add on but no luck

[skjennings · Accepted solution]

We had to remove the Splunk Application and Add-on. The previous admins had custom parsing scripts.

[richgalloway]

@skjennings, if your problem is resolved, please accept an answer to help future users.

[skjennings]

The answer would not show for me after I first submitted it.

[DalJeanis]

If nothing else, you can download the table to another box, then use settings>Lookups>Lookup table files to upload it again in the appropriate app, and settings>Lookup>Lookup definitions to define it.