All Apps and Add-ons

Sentinel TA: The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'

ehudb
Contributor

The TA ships with automatic lookup on sourcetype 'threat'.
This automatic lookup is based on KV_Store lookup.

After installing the TA, we get on every search the following warning from indexers:

"The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'"
0 Karma
1 Solution

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

View solution in original post

0 Karma

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...