"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'fe_cef_syslog' and lookup table 'fireeye_severity_lookup'" - how to fix?

[kannanmallan]

We are on Splunk Cloud 6.4. We have Splunk Enterprise Security too.

FireEye App for Splunk Enterprise v3 (ver 3.0.8) was installed. Ever since we installed that, we've been getting the below errors in all queries.

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'fe_cef_syslog' and lookup table 'fireeye_severity_lookup'

Also, the FireEye app doesn't show any value..it shows all ZEROs..

Any help on how to fix the above issues?

In one of the posts, I read that the legacy FireEye add-on TA 3.3.0 should be disabled..will this impact the existing fireEye_CEF log formats if disabled?

[samsingnok52]

I am facing a similar issue in my splunk cloud,getting the error like "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?::){0}XmlWinEventLog:*' and lookup table 'identity_lookup_expanded'."

Kindly advice....

[richgalloway]

@samsingnok52 , this question is more than a year old and so you are unlikely to see many responses to your comment. You should post a new question describing your problem.

[TonyLeeVT]

Enterprise security ships with an old TA. When that is disabled you should stop receiving those error messages.

The app most likely shows up as all zeros because the sourcetype you are using (fireEye_CEF) is incorrectly named and as a result the data is not being properly parsed.

Check out the supported sourcetypes on our details page:

Sourcetypes
===========
Supported protocols and corresponding sourcetypes are:
------------------------------------------------------
| Protocol/format                 | Sourcetype       |
|---------------------------------|------------------|
| 1)  JSON over HTTPS             | fe_json          |
| 2)  XML over HTTPS              | fe_xml           |
| 3)  CEF over SYSLOG - TCP       | fe_cef_syslog    |
| 4)  CEF over SYSLOG - UDP       | fe_cef_syslog    |
| 5)  XML over SYSLOG - TCP       | fe_xml_syslog    |
| 6)  XML over SYSLOG - UDP       | fe_xml_syslog    |
| 7)  JSON over SYSLOG - TCP      | fe_json_syslog   |
| 8)  JSON over SYSLOG - UDP      | fe_json_syslog   |
| 9)  CSV over SYSLOG - TCP       | fe_csv_syslog    |
| 10)  CSV over SYSLOG - UDP      | fe_csv_syslog    |
| HX Endpoint Appliance           | hx_cef_syslog    |
| Threat Analytics Platform (TAP) | fe_tap_json      |
| Email Threat Prevention (ETP)   | fe_etp           |
------------------------------------------------------

Source: https://splunkbase.splunk.com/app/1845/#/details

Hope that helps.