All Apps and Add-ons

Warning messages in Dell SonicWALL Analytics version 1.0.2

tayyujie
Explorer

I noticed that in version 1.0.2 of Dell SonicWALL Analytics for Splunk, there are warning messages that appears in all the panels, similar to the one in version 1.0.

The lookup table 'protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'protocol_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
Tags (1)
0 Karma
1 Solution

jalfrey
Communicator

go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv

It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups

I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.

View solution in original post

0 Karma

jalfrey
Communicator

go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv

It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups

I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.

0 Karma

tayyujie
Explorer

Thank you. Apparently, something went wrong during the installation of version 1.0.2. After re-installation, everything is working well.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...