We are getting the following error when we run queries:
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan:newapps'.
Looks like someone deleted the lookup table in the Splunk instance but it still exists on the disk. I just do not know how to have it generate the table and definition.
Note: I tried to reinstall the add on but no luck
We had to remove the Splunk Application and Add-on. The previous admins had custom parsing scripts.
We had to remove the Splunk Application and Add-on. The previous admins had custom parsing scripts.
@skjennings, if your problem is resolved, please accept an answer to help future users.
The answer would not show for me after I first submitted it.
If nothing else, you can download the table to another box, then use settings>Lookups>Lookup table files to upload it again in the appropriate app, and settings>Lookup>Lookup definitions to define it.