I noticed that in version 1.0.2 of Dell SonicWALL Analytics for Splunk, there are warning messages that appears in all the panels, similar to the one in version 1.0.
The lookup table 'protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'protocol_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_descriptions' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_risk_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_app_tech_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_bwm' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_flow_block_reason' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_gav_names' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_interfaces' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_location' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_os_guess' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_ratings' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_template_id' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'dell_ipfix'.
The lookup table 'sonicwall_voip_media_type' does not exist. It is referenced by configuration 'source::dell_ipfix://Dell_IPFIX|host::<ip address>|dell_ipfix'.
The lookup table 'sonicwall_voip_protocol_type' does not exist. It is referenced by configuration 'dell_ipfix'.
go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv
It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups
I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.
go to apps -> dell sonicwall analytics
Settings -> Lookups -> Lookup table files
You should see a long list of files. The protocols is called sonicwall_protocol.csv the next error you are getting is for sonicwall_applications_details.csv
It looks like none of your lookup files are present or the definitions for them are missing. The files should be located in $SPLUNK_HOME/etc/apps/dsa/lookups
I recommend re-installing the application. It will replace all the default files and lookup for you. Any changes/configuration will end up in /local and not be changed.
Thank you. Apparently, something went wrong during the installation of version 1.0.2. After re-installation, everything is working well.