I just installed the Splunk App for *nix (version 5.0.0-182057) on my Indexer/Search Head. I have also configured a deployed server to use the Splunk App for *nix to log using the scripted inputs. If I use the Search & Reporting app with index=os or sourcetype=lastlog, results are displayed.
However, if I try to use the Splunk App for *nix on the Search Head, I get the error message:
The lookup table 'dropdowns.csv' is invalid.
The specified search will not match any events
[subsearch]: The lookup table 'dropdownsLookup' is invalid.
I checked the Search Heads $SPLUNK_HOME and the dropdown.csv file does not exist. Is this file missing from the install package?
Ok. In the SA-nix TA, there's a saved search called "__generate_lookup_dropdowns". Try running this manually by copying the search text and running it in the "search" bar of the unix app. That should create your dropdown...
The solution is documented here:
The app complains about a missing or
invalid dropdowns.csvThis error occurs when you skip the
first-time configuration screen. To
fix it, configure the app by selecting
"Settings" from the main app menu, and
from the Settings screen, selecting
"Categories."
Ok. In the SA-nix TA, there's a saved search called "__generate_lookup_dropdowns". Try running this manually by copying the search text and running it in the "search" bar of the unix app. That should create your dropdown...
I believe this dropdown should reside in the "SA-nix" app within etc/apps. Can you try checking that app and seeing if the lookup exists (it would be in a sub-directory called "lookups")?
That worked! Thank you.
I checked the lookups directory inside SA-nix, and the dropdown.csv file does not exist. Even doing an:
unzip -l splunk_app_for_nix-5.0.0-182057 | grep dropdown.csv
on the *nix app package yields no results. I believe you are right about the file's location, because the splunk_app_for_nix app has code in appserver/controllers/unixsetup.py:
dropdownsCsv = os.path.join(util.get_apps_dir(), 'SA-nix', 'lookups', 'dropdowns.csv')