All Apps and Add-ons

Why are other apps showing errors about missing PAN lookup files after upgrading Splunk for Palo Alto Networks to 4.1.2?

JSapienza
Contributor

After the upgrade to 4.1.2 I started seeing this error in other app dashboards specifically my Cisco dash:

 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}XmlWinEventLog:*'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?i)source::....zip(.\d+)?'.
 [splunkindex1] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex1] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex1] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex1] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}XmlWinEventLog:*'.
 [splunkindex1] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?i)source::....zip(.\d+)?'.

I thought it might be the metadata/default.meta but its unmodified.

# TODO: should these only exported to app instead of system?

 # Application-level permissions

 []
 access = read : [ * ], write : [ admin, power ]

 ### EVENT TYPES

 [eventtypes]
 export = system


 ### PROPS

 [props]
 export = system


 ### TRANSFORMS

 [transforms]
 export = system

 [savedsearches]
 export = none

 [lookups]
 export = none


Any ideas ?

Thanks !

,After the upgrade to 4.1.2 I started seeing the following errors in other apps :

 The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
 [splunkindex0] The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
 [splunkindex0] The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration '(?::){0}PerfmonMk*:*'.


These lookup files do in fact exist here: /apps/SplunkforPaloAltoNetworks/lookups/

I have a feeling this might be a metadata/default.meta problem since it was working fine before the upgrade .
default.meta
# TODO: should these only exported to app instead of system?

 # Application-level permissions

 []
 access = read : [ * ], write : [ admin, power ]

 ### EVENT TYPES

 [eventtypes]
 export = system


 ### PROPS

 [props]
 export = system


 ### TRANSFORMS

 [transforms]
 export = system

 [savedsearches]
 export = none

 [lookups]
 export = none

Any Ideas ?

neelamssantosh
Contributor

Don't upgrade the SplunkforPaloAltoNetworks version directly from Splunk web, instead download the new version package and replace with existing apps.
it will resolve the problem.

It helped me, hope the same for you.
happy Splunking..:)

0 Karma

btorresgil
Builder

Hi JSapienza,

Thanks for pointing out this issue, I put out a fix in version 4.1.3 of the app. Let me know in a comment if there are any other problems you notice with the meta files.

Thanks!
-Brian

afhussain
Explorer

hi Brian,

I just updated our app to 4.1.3 and i have a opposite problem. We have other apps that use field extractions defined by your app but now they cannot see it. I have set the the permission to "All Apps" via GUI and have restarted but no luck. Please advice.

Thanks,
Adnan

0 Karma

btorresgil
Builder

Hi Adnan! Yes, some people liked that the fields and lookups were available globally. But, best practices have changed over the years and the app is being a better Splunk-citizen by making the fields local to the app by default. It helps prevent name overlap with other apps. If you prefer, you can always make them global again by modifying the file SplunkforPaloAltoNetworks/metadata/local.meta. You'll want to set export=system for the following sections: [props], [transforms] and [lookups]

jconger
Splunk Employee
Splunk Employee

props.conf defines the lookups. default.meta is exporting the props to system - so all apps see this. However, the lookups are set to only the app context (not system). This is why other apps are complaining - they see a definition for a lookup, but cannot see the file defined in the lookup.

To remedy, make a copy of default.meta and name it local.meta. Set all your exports to none in local.meta. When Splunk restarts, everything in local.meta will override default.meta. This will keep all the PAN knowledge contained within the PAN app and will not impact other apps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...