The lookup table 'wmi_version_range_lookup' does not exist. It is referenced by configuration 'WMI:Version'.

[Masa]

After installing the latest windows app, 4.5, on a search head, we started to see the following errors

The lookup table 'wmi_version_range_lookup' does not exist. It is referenced by configuration 'WMI:Version'.
The lookup table 'windows_vendor_info_lookup' does not exist. It is referenced by configuration 'source::*:System'.

How can I solve this issue?

[Masa · Accepted solution]

This is a bug with missing a configuration in the latest windows app.

To fix this issue, edit $SPLUNK_HOME/etc/apps/windows/metadata/local.meta

and, add following line;

[lookups]
export = system


[dbriggs]

I'm getting exact same error after upgrading from 4.5.1 to 4.5.2. This solution doesn't resolve the problem in my case. And looking in the defualt.meta file this parameter already exists under the [lookups] tag. I also added to local.meta, no go.

[alexoldman]

that worked a treat - thanks

[Masa]

Thanks, Alex. I was looking for your answer, that link.

[araitz]

http://splunk-base.splunk.com/answers/39350/using-splunk-for-windows-on-a-linux-search-head