All Apps and Add-ons

Sentinel TA: The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'

ehudb
Contributor

The TA ships with automatic lookup on sourcetype 'threat'.
This automatic lookup is based on KV_Store lookup.

After installing the TA, we get on every search the following warning from indexers:

"The lookup table 'agents_list' does not exist. It is referenced by configuration 'threat'"
0 Karma
1 Solution

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

View solution in original post

0 Karma

ehudb
Contributor

The fix is to add to collections.conf under [agents]

[agents]
replicate = true

The reason is coming from this requirement for KV-Store automatic lookups:

You can make all lookup types automatic. However, KV Store lookups have an additional setup step that you must complete before you configure them as automatic lookups in props.conf. See Enable replication for a KV Store collection.

http://docs.splunk.com/Documentation/Splunk/7.0.2/Knowledge/Makeyourlookupautomatic#The_automatic_lo...

I would notify the app creator, but couldn't find a way to contact him.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...