Splunk Search

Why are there errors when resolving missing lookup tables/fields?

afolabia
Path Finder

I'm having errors resolving several missing lookup tables. Any help to resolve these will be appreciated.

The lookup table 'xmlsecurity_eventcode_errorcode_action_lookup' does not exist. It is referenced by configuration 'source::XmlWinEventLog:Security'

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'WMI:WinEventLog:Security' and lookup table 'windows_app_lookup'

The lookup table 'windows_severity_lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:System'

Thanks

0 Karma

lakshman239
Influencer

Looks like your install/upgrade of Splunk add-on for windows didn't go through fine. Pls re-install/upgrade again and use version 5.x or 6.x [ has major changes]

0 Karma

bullbo
Engager

Reloaded Splunk add-on for Windows (v7.0) and still get the same errors. Anything else it could be?

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...