Splunk "ip_lookups table does not exist" error

[pilotbri]

I'm getting a red triangle with the error "The lookup table 'ip_lookups' does not exist. It is referenced by configuration 'json-too_small'."

any ideas?

[jmangs]

I fixed this by putting the json-too_small : LOOKUP-ip_dst_lookups and json-too_small : LOOKUP-ip_src_lookups automatic lookups created by the nprobe application to App only sharing. In my case, it was shared globally. Strangely enough, I didn't have this issue on all of my indexers either so I'm not sure the exact cause but it's probably related to permissions.

[drelo]

I've got the same issue on 6.4 & it appears to be tied to the probe app too. Did you manage to resolve this?

[0YAoNnmRmKDg]

Hi,

Just to confirm there are no lookups built into the freenas app, so likely from another app.

Let me know if you do find it linked though!

Cheers

[martin_mueller]

Check for an automatic lookup defined for sourcetype json-too_small referring a lookup definition called ip_lookups that doesn't exist or isn't shared with your roles.

[martin_mueller]

You should remove the FreeNAS tag if you've found it to be not guilty.

[pilotbri]

actually, it looks like the problem started with nprobe and not freenas. But I'll poke around there and see what I can find.