- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Upgraded Splunk for Symantec from 1.0 to 1.03 ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Upgraded to the latest version of the app and TAs. Getting the following error on the search console.
The lookup t able 'sep_vendor_info_lookup' does not exist. It is referenced by configuration "sep11:system'
This is coming from both indexers. Is the TA not deployed properly?
Splunk is currently at version 5.0.4
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup got lost or its permissions did not transfer in the upgrade.
Go to Manager>Lookups>Automatic Lookups, select all apps, find sep_ vendor _info_lookup and check the permissions. If the lookup does not exist, then check the Manager>Lookup definitions for all apps. If it does not exist, then it will have to be recreated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup got lost or its permissions did not transfer in the upgrade.
Go to Manager>Lookups>Automatic Lookups, select all apps, find sep_ vendor _info_lookup and check the permissions. If the lookup does not exist, then check the Manager>Lookup definitions for all apps. If it does not exist, then it will have to be recreated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After looking back it appears that the I needed to recreate the lookup as sep_vendor_info_lookup with the specific version as they were created. With that it appears the errors have cleared up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check the permissions in the Automatic Lookup for applicable Apps. Make sure it is set to include the app throwing the error (I set mine to Global).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Both sep11_vendor_info_lookup and sep12_vendor_info_lookup exist. The permissions are write for admin and read for all other users. Does this sound correct?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
