After upgrading Palo Alto Networks App for Splunk from 4.x to 5.0.0, getting "Could not find all of the specified destination fields in the lookup table"

[perreau]

I went for the upgrade head first and did it via the GUI and now I had to give everyone full permission to the app to at least see something on the graphs. That's done, but I am not seeing my old logs and even the new logs are not fully showing e.g. the overview dashboard is not populating. Please help 😞

[btorresgil · Accepted solution]

Hi perreau,

Please follow the 5.0 upgrade guide here:
http://pansplunk.readthedocs.org/en/latest/upgrade.html

It will resolve the problems including the errors you posted.
Thanks!
-Brian

[perreau]

Hi Brian. Thanks so much for helping and all is now OK 🙂

That's a typical example of me not RTFM 😉

(y)

[perreau]

I am also seeing these:

10 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.

Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:config' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:hipmatch' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:newapps' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:system' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:threat' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:traffic' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'pan:wildfire_report' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'source::udp:5514|host::xxx.x.xx.xxx|pan:threat' and lookup table 'pan_vendor_info_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'pan:threat' and lookup table 'threat_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'source::udp:5514|host::xxx.x.xx.xxx|pan:threat' and lookup table 'threat_lookup'.