Splunk App for *nix missing dropdown.csv

[rseagle07]

I just installed the Splunk App for *nix (version 5.0.0-182057) on my Indexer/Search Head. I have also configured a deployed server to use the Splunk App for *nix to log using the scripted inputs. If I use the Search & Reporting app with index=os or sourcetype=lastlog, results are displayed.

However, if I try to use the Splunk App for *nix on the Search Head, I get the error message:

The lookup table 'dropdowns.csv' is invalid.
The specified search will not match any events
[subsearch]: The lookup table 'dropdownsLookup' is invalid.

I checked the Search Heads $SPLUNK_HOME and the dropdown.csv file does not exist. Is this file missing from the install package?

[bshuler_splunk]

The solution is documented here:

http://docs.splunk.com/Documentation/UnixApp/latest/User/TroubleshoottheSplunkAppforUnixandLinux#The...

The app complains about a missing or
invalid dropdowns.csv

This error occurs when you skip the
first-time configuration screen. To
fix it, configure the app by selecting
"Settings" from the main app menu, and
from the Settings screen, selecting
"Categories."

[BenjaminWyatt · Accepted solution]

Ok. In the SA-nix TA, there's a saved search called "__generate_lookup_dropdowns". Try running this manually by copying the search text and running it in the "search" bar of the unix app. That should create your dropdown...

[BenjaminWyatt]

I believe this dropdown should reside in the "SA-nix" app within etc/apps. Can you try checking that app and seeing if the lookup exists (it would be in a sub-directory called "lookups")?

[rseagle07]

That worked! Thank you.

[rseagle07]

I checked the lookups directory inside SA-nix, and the dropdown.csv file does not exist. Even doing an:

unzip -l splunk_app_for_nix-5.0.0-182057 | grep dropdown.csv

on the *nix app package yields no results. I believe you are right about the file's location, because the splunk_app_for_nix app has code in appserver/controllers/unixsetup.py:

dropdownsCsv = os.path.join(util.get_apps_dir(), 'SA-nix', 'lookups', 'dropdowns.csv')