Lookup table does not exist error on update to 4.1

[Yancy]

Since I updated our server to 4.1.2 I'm seeing the following error with most searches.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'.

I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux.

[Ledio_Ago · Accepted solution]

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

[Yancy]

Thanks Ledio, that resolved the issue for me.