- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- lookup table does not exist
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
lookup table does not exist
I am having an issue where anyone that does a splunk search gets the following error:
The lookup table 'event_id_to_action_lookup' does not exist. It is referenced by configuration 'MSExchange:2013:MessageTracking'
I would be most obliged for any insight that anyone would be able to provide about this issue.
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gl0balt3kkie, the automatic lookup file is most likely missing from your splunk server i.e. it may not be on disk anymore. Either an app search/splunk collections were not enabled again. At times the lookup file maybe removed from a splunk version/app upgrade, usually the latter, but it's best to check if it's on disk manually.
You can find where the lookup file is located by checking the lookup definition, followed by the file itself, on the UI. Simply navigate to...
UI > Settings > Lookups > Lookup definitions > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup" in the search filter and hit find.
Once you see the lookup filename, then you can navigate to...
UI > Settings > Lookups > Lookup table files > Select "All" for App Context > Select Owner as "Any" > Enter "event_id_to_action_lookup.csv" (if it is the same filename) in the search filter and hit find.
You will see the folder path for the lookup file.
The actual "event_id_to_action_lookup.csv" lookup file is part of the "TA-Exchange-Mailbox" app (TA-Exchange-Mailbox/lookups folder) which can be found here if you download "Splunk Add-on for Microsoft Exchange" app.
https://splunkbase.splunk.com/app/3225/
If this file is missing from your search head, you will need to import it back.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ok, thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I do a search at UI > Settings > Lookups > Lookup Definitions and ALL and ANY I get the following:
"There are no configurations of this type. Click the "New" button to create a new configuration."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have any lookup files in the "UI > Settings > Lookups > Lookup table files" section?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, quite a few. However, I get the same message as above when I do a search for : event_id_to_action_lookup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide the Splunk search you used?
Do you have necessary access to the lookup file?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
