Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?

[JSapienza]

After the upgrade to 4.1.2 I started seeing this error in other app dashboards specifically my Cisco dash:

 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}XmlWinEventLog:*'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?i)source::....zip(.\d+)?'.
 [splunkindex1] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex1] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex1] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex1] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}XmlWinEventLog:*'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?i)source::....zip(.\d+)?'.

I thought it might be the metadata/default.meta but its unmodified.

# TODO: should these only exported to app instead of system?

 # Application-level permissions

 []
 access = read : [ * ], write : [ admin, power ]

 ### EVENT TYPES

 [eventtypes]
 export = system


 ### PROPS

 [props]
 export = system


 ### TRANSFORMS

 [transforms]
 export = system

 [savedsearches]
 export = none

 [lookups]
 export = none


Any ideas ?

Thanks !

,After the upgrade to 4.1.2 I started seeing the following errors in other apps :

 The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.


These lookup files do in fact exist here: /apps/SplunkforPaloAltoNetworks/lookups/

I have a feeling this might be a metadata/default.meta problem since it was working fine before the upgrade .
default.meta
# TODO: should these only exported to app instead of system?

 # Application-level permissions

 []
 access = read : [ * ], write : [ admin, power ]

 ### EVENT TYPES

 [eventtypes]
 export = system


 ### PROPS

 [props]
 export = system


 ### TRANSFORMS

 [transforms]
 export = system

 [savedsearches]
 export = none

 [lookups]
 export = none

Any Ideas ?

[neelamssantosh]

Don't upgrade the SplunkforPaloAltoNetworks version directly from Splunk web, instead download the new version package and replace with existing apps.
it will resolve the problem.

It helped me, hope the same for you.
happy Splunking..:)

[btorresgil]

Hi JSapienza,

Thanks for pointing out this issue, I put out a fix in version 4.1.3 of the app. Let me know in a comment if there are any other problems you notice with the meta files.

Thanks!
-Brian

[afhussain]

hi Brian,

I just updated our app to 4.1.3 and i have a opposite problem. We have other apps that use field extractions defined by your app but now they cannot see it. I have set the the permission to "All Apps" via GUI and have restarted but no luck. Please advice.

Thanks,
Adnan

[btorresgil]

Hi Adnan! Yes, some people liked that the fields and lookups were available globally. But, best practices have changed over the years and the app is being a better Splunk-citizen by making the fields local to the app by default. It helps prevent name overlap with other apps. If you prefer, you can always make them global again by modifying the file SplunkforPaloAltoNetworks/metadata/local.meta. You'll want to set export=system for the following sections: [props], [transforms] and [lookups]

[jconger]

props.conf defines the lookups. default.meta is exporting the props to system - so all apps see this. However, the lookups are set to only the app context (not system). This is why other apps are complaining - they see a definition for a lookup, but cannot see the file defined in the lookup.

To remedy, make a copy of default.meta and name it local.meta. Set all your exports to none in local.meta. When Splunk restarts, everything in local.meta will override default.meta. This will keep all the PAN knowledge contained within the PAN app and will not impact other apps.