Single Splunk server- PA app 4.1.1 was working without issue.
Updated to 4.1.3 and now all we get are following errors when we do a basic search for 'pan_traffic'.
Server was restarted - twice, errors still continue.
The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_threat'.
The lookup table 'app_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
The lookup table 'app_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::192.168.18.100|pan_traffic'.
The lookup table 'app_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::192.168.99.20|pan_traffic'.
The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_threat'.
The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::192.168.18.100|pan_traffic'.
The lookup table 'classification_lookup' does not exist. It is referenced by configuration 'source::udp:514|host::192.168.99.20|pan_traffic'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'flowintegrator'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_config'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_newapps'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_system'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_threat'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_traffic'.
The lookup table 'pan_vendor_info_lookup' does not exist. It is referenced by configuration 'pan_wildfire_report'.
Update:
Initially, I had updated from the Web UI, checking the update box (which is when the issue started).
I uninstalled the app (deleted the folder), then manually copy it from the tar ball, restarted and it started working.
When in doubt, use the old fashioned ways...
Update:
Initially, I had updated from the Web UI, checking the update box (which is when the issue started).
I uninstalled the app (deleted the folder), then manually copy it from the tar ball, restarted and it started working.
When in doubt, use the old fashioned ways...
There was probably something stuck in the 'local' folder for your app instance that was causing a problem. Glad it's fixed!