Splunk Search

The lookup table '...' does not exist

After installing the Windows App 5.0.2 on our splunk 5.0.3 i get these errors when doing a search:

The lookup table 'wmiversionrangelookup' does not exist. It is referenced by configuration 'WMI:Version'.

The lookup table 'msdhcp
signature_lookup' does not exist. It is referenced by configuration 'DhcpSrvLog'.

I found this thread splunk answers but this didn't help ...

Motivator

So I found that lookup tables are very picky. If they exist at an app level, they are only available for that app, no matter the permissions.
If you replace a lookup table, you must open the definition and automation and re-save them
One way to make them "less" picky is to put them at the system level, this makes them available in all apps. .. more info on that here: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources

If you need to package the app, i found it necessary to add the lookup file/definition/automation to each app.

0 Karma

Motivator

I had to rerun the lookup search to create the lookup file manually after this. Once I did that, everything started working fine!

0 Karma

New Member

I have the same issue and the thread listed didn't help me either.

0 Karma