Splunk Enterprise Security

"Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'fe_cef_syslog' and lookup table 'fireeye_severity_lookup'" - how to fix?

kannanmallan
New Member

We are on Splunk Cloud 6.4. We have Splunk Enterprise Security too.

FireEye App for Splunk Enterprise v3 (ver 3.0.8) was installed. Ever since we installed that, we've been getting the below errors in all queries.

Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'fe_cef_syslog' and lookup table 'fireeye_severity_lookup'

Also, the FireEye app doesn't show any value..it shows all ZEROs..

Any help on how to fix the above issues?

In one of the posts, I read that the legacy FireEye add-on TA 3.3.0 should be disabled..will this impact the existing fireEye_CEF log formats if disabled?

0 Karma

samsingnok52
Engager

I am facing a similar issue in my splunk cloud,getting the error like "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf '(?::){0}XmlWinEventLog:*' and lookup table 'identity_lookup_expanded'."

Kindly advice....

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@samsingnok52 , this question is more than a year old and so you are unlikely to see many responses to your comment. You should post a new question describing your problem.

---
If this reply helps you, Karma would be appreciated.
0 Karma

TonyLeeVT
Builder

Enterprise security ships with an old TA. When that is disabled you should stop receiving those error messages.

The app most likely shows up as all zeros because the sourcetype you are using (fireEye_CEF) is incorrectly named and as a result the data is not being properly parsed.

Check out the supported sourcetypes on our details page:

Sourcetypes
===========
Supported protocols and corresponding sourcetypes are:
------------------------------------------------------
| Protocol/format                 | Sourcetype       |
|---------------------------------|------------------|
| 1)  JSON over HTTPS             | fe_json          |
| 2)  XML over HTTPS              | fe_xml           |
| 3)  CEF over SYSLOG - TCP       | fe_cef_syslog    |
| 4)  CEF over SYSLOG - UDP       | fe_cef_syslog    |
| 5)  XML over SYSLOG - TCP       | fe_xml_syslog    |
| 6)  XML over SYSLOG - UDP       | fe_xml_syslog    |
| 7)  JSON over SYSLOG - TCP      | fe_json_syslog   |
| 😎  JSON over SYSLOG - UDP      | fe_json_syslog   |
| 9)  CSV over SYSLOG - TCP       | fe_csv_syslog    |
| 10)  CSV over SYSLOG - UDP      | fe_csv_syslog    |
| HX Endpoint Appliance           | hx_cef_syslog    |
| Threat Analytics Platform (TAP) | fe_tap_json      |
| Email Threat Prevention (ETP)   | fe_etp           |
------------------------------------------------------

Source: https://splunkbase.splunk.com/app/1845/#/details

Hope that helps.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...