All Apps and Add-ons

Sentinel TA: The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'

ehudb
Contributor

The TA ships with automatic lookup on sourcetype 'threat'.
This automatic lookup is based on KV_Store lookup.

After installing the TA, we get on every search the following warning from indexers:

"The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'"
0 Karma
1 Solution

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

View solution in original post

0 Karma

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.