All Apps and Add-ons

Warning messages in Dell SonicWALL Analytics version 1.0.2

tayyujie
Explorer

I noticed that in version 1.0.2 of Dell SonicWALL Analytics for Splunk, there are warning messages that appears in all the panels, similar to the one in version 1.0.

The lookup table 'protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'protocol_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
Tags (1)
0 Karma
1 Solution

jalfrey
Communicator

go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv

It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups

I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.

View solution in original post

0 Karma

jalfrey
Communicator

go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv

It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups

I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.

0 Karma

tayyujie
Explorer

Thank you. Apparently, something went wrong during the installation of version 1.0.2. After re-installation, everything is working well.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...