Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.

[kmanson]

How do I resolve this error?

[idx1] The lookup table 'sqlserver_host_dbserver_lookup' does not exist. It is referenced by configuration 'mssql:execution:dm_exec_query_stats'.

Environment:
Splunk 6.4.2
Indexer Cluster
Splunk Add-on for Microsoft SQL Server 1.2.0

[kmanson · Accepted solution]

Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.

Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv

Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv

[DavidH1]

Oh brilliant, thank you.

[bsachitano]

Question, does the old transforms.conf get deleted and replaced with the one in the local folder?

I'm still getting indexer errors on this lookup table.

[ChrisBell04]

@bsachitano
No. you leave the existing transforms untouched.
Create splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
and paste:
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv

make sure that gets deployed to the indexers and search heads.

[smitra_splunk]

Thank you! 🙂

[jlarosa]

Thank you for your answer, it worked for me. This add-on still has not seen an update to fix this.

[ChrisBell04]

Support case created and enhancement ADDON-9403 created to get this finally fixed.

[paimonsoror]

Had the same issue today, and this solution still worked 🙂 Thanks!!

[mattamos]

Just what I needed, thanks! Still not fixed in 6.5.2.

[guilmxm]

As a Splunk app developer I personally don't understand why this is still not corrected.

This is a "Splunk built app", and this configuration error is literally very basic (and obviously difficult to understand how it could be there)

A little bit a shame in my opinion.

[gjanders]

Agreed, part of the reason I post answers to questions like this is in the hope that the splunk developer will notice and integrate them in.
Sometimes I also make the effort to log an enhancement case with a solution provided to assist Splunk but this can be time consuming and I do not always have spare time!

[jrodmantcell]

IMO, there is an insufficiency of tooling, support, and autovalidation around app paths to have any real hope that apps actually work in the various configurations in general. I view this problem as emblematic of the need for proper tools for expressing paths and automatic validations of those expressions. This isn't an isolated case, all kinds of splunk-built apps get stuff like this wrong all the time.

[trross33]

Thank you kmanson. It is not often someone follows up on their own post after finding a solution. We appreciate it.

[gjanders]

I actually used the exact same solution yesterday and I've just found your post today.
I've submitted a case to Splunk to ensure this gets fixed in a future version.