Verify that lookups installed with Splunk Security Essentials is present

[tkreiner]

I have confirmed now that the app is no longer replicating the lookup files up to the indexer through bundle replication. However, when I use the Use Case pages, I'm seeing the error above in the Data Check panel. When I click on the Open in Search link, I see that it is using a REST call to determine if the lookup is available. However, the REST call is going against the search peers (which no longer have the replicated copy) and not against the local Splunk instance.

I traced the configurations back to the JSON files in appserver/static/components/data/samplesSearches and saw where that REST command was coded in the test values for each of the use cases. I appended "splunk_server=local" to each of the REST calls. After restarting Splunk, the Data Check panels were now reporting correctly.

Sample SPL command:
| rest /servicesNS/-/-/data//lookup-table-files splunk_server=local | eval blah=1, row=\"row\"| xyseries row title blah

[SamHTexas]

Where do I find this lookup & how do I verify it please?

[SamHTexas]

Does any good security person here know? My Security Essentials keeps asking for "Splunk Datasets add-on. Do I install it where the ES is installed ? 

[David]

First, apologies for the delay. Somehow I'd turned off notifications for the app.

Second, thank you for the bug fix! I just pushed version 1.4.4 with the fix! As soon as it goes through review, you should be able to see the correction.

Thanks for the report (and the patience)!