Sentinel TA: The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'

[ehudb]

The TA ships with automatic lookup on sourcetype 'threat'.
This automatic lookup is based on KV_Store lookup.

After installing the TA, we get on every search the following warning from indexers:

"The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'"

[ehudb · Accepted solution]

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.