Getting Data In

Lookup table does not exist error on update to 4.1

Yancy
Path Finder

Since I updated our server to 4.1.2 I'm seeing the following error with most searches.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'.

I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux.

Tags (3)
1 Solution

Ledio_Ago
Splunk Employee
Splunk Employee

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

View solution in original post

Ledio_Ago
Splunk Employee
Splunk Employee

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

View solution in original post

Yancy
Path Finder

Thanks Ledio, that resolved the issue for me.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!