All Apps and Add-ons

Sentinel TA: The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'

ehudb
Contributor

The TA ships with automatic lookup on sourcetype 'threat'.
This automatic lookup is based on KV_Store lookup.

After installing the TA, we get on every search the following warning from indexers:

"The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'"
0 Karma
1 Solution

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

View solution in original post

0 Karma

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...