Getting this error when searching.
The lookup table 'msdhcp_signature_lookup' does not exist. It is referenced by configuration 'DhcpSrvLog'.
The only references I can find for msdhcp_signature_lookup are in the $SPLUNK_HOME/etc/apps/windows/default in props.conf and transforms.conf
I have copied props.conf and transforms.conf into ../local (relative to above dir) and commented out lines referencing msdhcp_signture_lookup
Any suggestions on how to get rid of this error? Or how to track this down?
props.conf
[DhcpSrvLog]
SHOULD_LINEMERGE = false
REPORT-0auto_kv_for_microsoft_dhcp = auto_kv_for_microsoft_dhcp
REPORT-dest_for_microsoft_dhcp = dest_nt_host_as_dest,dest_mac_as_dest,dest_ip_as_dest
#LOOKUP-signature_for_microsoft_dhcp = msdhcp_signature_lookup msdhcp_id OUTPUTNEW signature
tranforms.conf
#[msdhcp_signature_lookup]
#filename = msdhcp_signatures.csv
... View more