All Apps and Add-ons

Splunk Add-on for Microsoft SQL Server: The lookup table 'sqlserver_host_dbserver_lookup' does not exist.

kmanson
Path Finder

How do I resolve this error?

[idx1] The lookup table 'sqlserver_host_dbserver_lookup' does not exist. It is referenced by configuration 'mssql:execution:dm_exec_query_stats'.

Environment:
Splunk 6.4.2
Indexer Cluster
Splunk Add-on for Microsoft SQL Server 1.2.0

1 Solution

kmanson
Path Finder

Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.

Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv

Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv

View solution in original post

kmanson
Path Finder

Posting my own answer in-case someone else runs into this bug. No more errors when lookup filename is modified on the search head. This happens because the default is referencing the full path, and on a index cluster the app is located in slave-apps and not apps.

Contents of splunk/etc/apps/Splunk_TA_microsoft-sqlserver/default/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = $SPLUNK_HOME/etc/apps/Splunk_TA_microsoft-sqlserver/lookups/sqlserver_host_dbserver_lookup.csv

Contents of new splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf

[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv

View solution in original post

DavidH1
Explorer

Oh brilliant, thank you.

0 Karma

bsachitano
Explorer

Question, does the old transforms.conf get deleted and replaced with the one in the local folder?

I'm still getting indexer errors on this lookup table.

0 Karma

ChrisBell04
Communicator

@bsachitano
No. you leave the existing transforms untouched.
Create splunk/etc/apps/Splunk_TA_microsoft-sqlserver/local/transforms.conf
and paste:
[sqlserver_host_dbserver_lookup]
filename = sqlserver_host_dbserver_lookup.csv

make sure that gets deployed to the indexers and search heads.

smitra_splunk
Splunk Employee
Splunk Employee

Thank you! 🙂

0 Karma

jlarosa
Engager

Thank you for your answer, it worked for me. This add-on still has not seen an update to fix this.

0 Karma

ChrisBell04
Communicator

Support case created and enhancement ADDON-9403 created to get this finally fixed.

0 Karma

paimonsoror
Builder

Had the same issue today, and this solution still worked 🙂 Thanks!!

0 Karma

mattamos
New Member

Just what I needed, thanks! Still not fixed in 6.5.2.

0 Karma

guilmxm
SplunkTrust
SplunkTrust

As a Splunk app developer I personally don't understand why this is still not corrected.

This is a "Splunk built app", and this configuration error is literally very basic (and obviously difficult to understand how it could be there)

A little bit a shame in my opinion.

0 Karma

gjanders
SplunkTrust
SplunkTrust

Agreed, part of the reason I post answers to questions like this is in the hope that the splunk developer will notice and integrate them in.
Sometimes I also make the effort to log an enhancement case with a solution provided to assist Splunk but this can be time consuming and I do not always have spare time!

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

jrodmantcell
Explorer

IMO, there is an insufficiency of tooling, support, and autovalidation around app paths to have any real hope that apps actually work in the various configurations in general. I view this problem as emblematic of the need for proper tools for expressing paths and automatic validations of those expressions. This isn't an isolated case, all kinds of splunk-built apps get stuff like this wrong all the time.

0 Karma

trross33
Path Finder

Thank you kmanson. It is not often someone follows up on their own post after finding a solution. We appreciate it.

gjanders
SplunkTrust
SplunkTrust

I actually used the exact same solution yesterday and I've just found your post today.
I've submitted a case to Splunk to ensure this gets fixed in a future version.

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!