Getting Data In

Lookup table does not exist error on update to 4.1

Path Finder

Since I updated our server to 4.1.2 I'm seeing the following error with most searches.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'.

I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux.

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

View solution in original post

Splunk Employee
Splunk Employee

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

View solution in original post

Path Finder

Thanks Ledio, that resolved the issue for me.