All Apps and Add-ons

Splunk App for *nix missing dropdown.csv

rseagle07
Explorer

I just installed the Splunk App for *nix (version 5.0.0-182057) on my Indexer/Search Head. I have also configured a deployed server to use the Splunk App for *nix to log using the scripted inputs. If I use the Search & Reporting app with index=os or sourcetype=lastlog, results are displayed.

However, if I try to use the Splunk App for *nix on the Search Head, I get the error message:

The lookup table 'dropdowns.csv' is invalid.
The specified search will not match any events
[subsearch]: The lookup table 'dropdownsLookup' is invalid.

I checked the Search Heads $SPLUNK_HOME and the dropdown.csv file does not exist. Is this file missing from the install package?

1 Solution

BenjaminWyatt
Communicator

Ok. In the SA-nix TA, there's a saved search called "__generate_lookup_dropdowns". Try running this manually by copying the search text and running it in the "search" bar of the unix app. That should create your dropdown...

View solution in original post

bshuler_splunk
Splunk Employee
Splunk Employee

The solution is documented here:

http://docs.splunk.com/Documentation/UnixApp/latest/User/TroubleshoottheSplunkAppforUnixandLinux#The...

The app complains about a missing or
invalid dropdowns.csv

This error occurs when you skip the
first-time configuration screen. To
fix it, configure the app by selecting
"Settings" from the main app menu, and
from the Settings screen, selecting
"Categories."

0 Karma

BenjaminWyatt
Communicator

Ok. In the SA-nix TA, there's a saved search called "__generate_lookup_dropdowns". Try running this manually by copying the search text and running it in the "search" bar of the unix app. That should create your dropdown...

BenjaminWyatt
Communicator

I believe this dropdown should reside in the "SA-nix" app within etc/apps. Can you try checking that app and seeing if the lookup exists (it would be in a sub-directory called "lookups")?

0 Karma

rseagle07
Explorer

That worked! Thank you.

0 Karma

rseagle07
Explorer

I checked the lookups directory inside SA-nix, and the dropdown.csv file does not exist. Even doing an:

unzip -l splunk_app_for_nix-5.0.0-182057 | grep dropdown.csv

on the *nix app package yields no results. I believe you are right about the file's location, because the splunk_app_for_nix app has code in appserver/controllers/unixsetup.py:

dropdownsCsv = os.path.join(util.get_apps_dir(), 'SA-nix', 'lookups', 'dropdowns.csv')

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>