Splunk Search

The lookup table '...' does not exist or is not available.

khsewell
Engager

Hi!,

This is a contrived example, but could you help me understand why this completes (and functions as expected):

 

| makeresults format=csv data="filename
calc.exe" | lookup isWindowsSystemFile_lookup filename

 

Whilst this:

 

index=sandbox | eval filename="calc.exe" | lookup isWindowsSystemFile_lookup filename

 

throws an error with message:

 

... The lookup table 'isWindowsSystemFile_lookup' does not exist or is not available.

 

The isWindowsSystemFile_lookup is provided by Splunk Security Essentials.

Hmm, I'm on splunk cloud.

Thanks,

Kevin

 

 

Labels (1)
0 Karma
1 Solution

khsewell
Engager

Thanks,
That made me dig in the right place, leading to ...
https://splunk.my.site.com/customer/s/article/User-is-getting-an-error-message-when 

Essentially,
... it was found that all the lookups present in the app “Splunk_Security_Essentials” are added in denylist by default.

Resolution to the error is to add local=true at the end of SPL command as below:
... | lookup isWindowsSystemFile_lookup filename local=true

The indexers need a read-only copy of the knowledge bundle in order to run searches. Splunk Security Essentials brings a significant amount of data that does not need to be copied to the search heads. Adding "local=true", forces the lookup to run on the search head and not on any remote peer.

That's ok for my purposes I think.

View solution in original post

khsewell
Engager

Thanks,
That made me dig in the right place, leading to ...
https://splunk.my.site.com/customer/s/article/User-is-getting-an-error-message-when 

Essentially,
... it was found that all the lookups present in the app “Splunk_Security_Essentials” are added in denylist by default.

Resolution to the error is to add local=true at the end of SPL command as below:
... | lookup isWindowsSystemFile_lookup filename local=true

The indexers need a read-only copy of the knowledge bundle in order to run searches. Splunk Security Essentials brings a significant amount of data that does not need to be copied to the search heads. Adding "local=true", forces the lookup to run on the search head and not on any remote peer.

That's ok for my purposes I think.

richgalloway
SplunkTrust
SplunkTrust

The first example runs entirely on the Search Head where the lookup definition is available.

The second example runs on the indexers, which apparently is unaware of the lookup definition.  Either the app defining the lookup is not installed on the indexers or the lookup file is blocked from the knowledge bundle ([replicationDenyList] in distsearch.conf).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...