All Apps and Add-ons

Splunk_TA_windows app version 4.8.3 was giving an error "could not find all the specified files in destination lookup table for conf [script:TimeSyncStatus] and lookup table windows_timesync _action_lookup_table"

nadeemanjum
Engager

But after changing props.conf stanza [script:Timesyncstatus] line LOOKUP-action_for_win_timesync_status = windows_timesync_action_lookup Last_Sync_Error OUTPUT action

to
LOOKUP-action_for_win_timesync_status = windows_timesync_action_lookup Last_Sync_Error OUTPUT windows_action, windows_action AS action

error disappeared is that a bug???

Tags (1)
0 Karma

hortonew
Builder

Doesn't seem to be. Your 2nd entry includes AS action, a portion missing from your first. The second one is the correct format, however I don't think it needs windows_action, windows_action twice.

0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...