Getting Data In

Splunk Add-on for Cisco ASA

Explorer

hi, after installing this plugin, i have errors on every search, realted to cisco or not...
Always see this errors:
Could not load lookup=LOOKUP-cisco-asa-actionlookup
Could not load lookup=LOOKUP-cisco-pix-action
lookup
Could not load lookup=LOOKUP-ciscofwsmaction_lookup

ss

i see this search is located in /opt/splunk/etc/apps/SplunkTAcisco-asa/default/props.conf but not sure what need to change to fix this?

thank you.

Tags (1)
0 Karma

Explorer

nothing changed. Cannot understand what i need to do in lookup definitions?
all seems fine by me 😄
i found post with similar case, but don`t understand what he changed: https://answers.splunk.com/answers/774032/splunk-add-on-for-cisco-asa.html

0 Karma

Communicator

This is a permission error in some way.
Sometime it is becuase a user have shared something globally.

When an app have the error it is often that it is not shared globally or not shared to the correct users, or from the wrong app.

Apps -> Manage Apps -> Sharing -> Permission

It can also be a good idee to search for the lookup yourself from other apps or the same and see if it will give you some hints)
Settings -> Lookups -> Lookup Definitions and search for the reported lookup. There you will see the name of the lookup file being used and the app which should own it. Create/replace the lookup file with the same name in that app

Explorer

hi, i added to everyone write permission but it is the same, still get errors... 😕

0 Karma

Communicator

What happens when you search for the lookup from an other app, or the same?

Go to Settings -> Lookups -> Lookup Definitions and search for the reported lookup. There you will see the name of the lookup file being used and the app which should own it. Create/replace the lookup file with the same name in that app and the error will go away (its worth a test)

And try change the permission on the other way so they are not shared globally only in app, but everyone can read them.

0 Karma

Communicator

How about read permission? And is it shared globally and not just in app?

0 Karma

Explorer

i think this is ok?
ss

0 Karma

Communicator

Yes, that is correct.

0 Karma

Explorer

and? 🙂
what can i do next?

do you have this addon?

0 Karma

Communicator

I updated my answer.
I have the app shared globally with everyone read and admin to write.
It maybe some local config errors on the lookup so try if you can use them urself.

0 Karma

Explorer

seems it is not issue with rights ...

0 Karma