Archive
Highlighted

Issues with PCI app after 4.1 upgrade

Engager

After the 4.1 upgrade we are getting errors in the GUI The lookup table 'port_security_list" does not exist. It is referenced by configuration 'wtmp'. The lookup table 'port_security_list" does not exist. It is referenced by configuration 'wmi'.

The error does not appear in any of the var/logs/splunk logfiles. The only place I have found a reference is in splunk/etc/apps/SplunkPCIComplianceSuite/defaults/transforms.conf

How do we fix this?

Trevor

Tags (2)
Highlighted

Re: Issues with PCI app after 4.1 upgrade

SplunkTrust
SplunkTrust

This is an issue with the way that lookup table scoping is handled in 4.1 - I had a similar issue.

Doc link here: http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/SetPermissions#Make_objects_globally_ava...

I was able to get past it by adding

[lookups]
export=system

to the default.meta or local.meta files in each app having the issue. Note: This will make the lookup table available globally, which might not be desirable, but you should be able to set the scoping as specifically as you want.

View solution in original post

Highlighted

Re: Issues with PCI app after 4.1 upgrade

Splunk Employee
Splunk Employee

If this is the problem, the migration script should have identified the possibility, but perhaps the message was missed.