Here are some links to (maybe) similar problems - does one refer to you?! http://answers.splunk.com/questions/2736/lookup-table-does-not-exist-error-on-update-to-4-1 http://answers.splunk.com/questions/10630/splunk-says-lookup-table-doesnt-exist-but-it-does http://answers.splunk.com/questions/6643/hostname-table-lookup-not-working-whats-the-issue http://answers.splunk.com/questions/1716/error-in-lookup-command-the-lookup-table-test-lookup-does-not-exist ... View more

Correlation Search Domain Anomalous Audit Trail Activity Detected audit Anomalous New Listening Port endpoint Anomalous New Processes endpoint Anomalous New Services endpoint Anomalous User Account Creation endpoint Brute Force Access Behavior Detected access Cleartext Password At Rest access Completely Inactive Account access Default Account Usage access Default Accounts At Rest access Excessive Failed Logins access Expected Host Not Reporting audit High Number of Hosts With Infection endpoint High Number Of Infected Hosts endpoint High Or Critical Priority Host With Malware endpoint Host With Excessive Number Of Listening Ports endpoint Host With Excessive Number Of Processes endpoint Host With Excessive Number Of Services endpoint Host With Multiple Infections endpoint Inactive Account Usage access Insecure Or Cleartext Authentication access Internet Proxy Server Activity network Known Web Attacker Activity network LogMeIn Activity network Old Malware Infection endpoint Personally Identifiable Information Detection audit PirateBay Activity network Policy Or Configuration Change network Prohibited Process Detection endpoint Prohibited Service Detection endpoint RapidShare Activity network Recurring Malware Infection endpoint SANS Block List Activity network Should Timesync Host Not Syncing endpoint Spyware Activity network Substantial Increase in an Event network Substantial Increase in Port Activity (By Destination) network Tor Router Activity network Unapproved Port Activity Detected network Unroutable Host Activity network Vulnerability Scanner Detection (by event) network Vulnerability Scanner Detection (by targets) network Watchlisted Events threat Nearly 50, but happy so far! Further I got an ESS User Guide from Splunk - unfortunately, it's not public!? ... View more

I guess it's similar to this one: http://answers.splunk.com/questions/3994/multiple-transactions-in-a-single-search gkanapathy mentioned several sourcetypes with one transaction command ... View more

Is your forwarder & receiver properly working? If not you may check these out first: http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving ... View more