- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

How do I resolve this error?
[idx1] The lookup table 'sqlserver_host_dbserver_lookup' does not exist. It is referenced by configuration 'mssql:execution:dm_exec_query_stats'.
Environment:
Splunk 6.4.2
Indexer Cluster
Splunk Add-on for Microsoft SQL Server 1.2.0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.
Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv
Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.
Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv
Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh brilliant, thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Question, does the old transforms.conf get deleted and replaced with the one in the local folder?
I'm still getting indexer errors on this lookup table.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bsachitano
No. you leave the existing transforms untouched.
Create splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
and paste:
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv
make sure that gets deployed to the indexers and search heads.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Thank you! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your answer, it worked for me. This add-on still has not seen an update to fix this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Support case created and enhancement ADDON-9403 created to get this finally fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Had the same issue today, and this solution still worked 🙂 Thanks!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just what I needed, thanks! Still not fixed in 6.5.2.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As a Splunk app developer I personally don't understand why this is still not corrected.
This is a "Splunk built app", and this configuration error is literally very basic (and obviously difficult to understand how it could be there)
A little bit a shame in my opinion.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Agreed, part of the reason I post answers to questions like this is in the hope that the splunk developer will notice and integrate them in.
Sometimes I also make the effort to log an enhancement case with a solution provided to assist Splunk but this can be time consuming and I do not always have spare time!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IMO, there is an insufficiency of tooling, support, and autovalidation around app paths to have any real hope that apps actually work in the various configurations in general. I view this problem as emblematic of the need for proper tools for expressing paths and automatic validations of those expressions. This isn't an isolated case, all kinds of splunk-built apps get stuff like this wrong all the time.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you kmanson. It is not often someone follows up on their own post after finding a solution. We appreciate it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I actually used the exact same solution yesterday and I've just found your post today.
I've submitted a case to Splunk to ensure this gets fixed in a future version.
