Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Errors increasing on search where "lookup table does not exist" for multiple sources but lookups have status of disabled

$
0
0
When running ad-hoc searches, I am getting errors that are increasing. My last search produced "20 errors occurred while the search was executing. Therefore, search results might be incomplete.". When I expand the message, it shows that each message is looking for a lookup table that does not exist. An example message is "The lookup table 'ftnt_action_lookup' does not exist. It is referenced by configuration 'fgt_traffic'". When I do a view objects for the apps and find the lookup shown in the error message, each show a status of "Disabled". I tried to enable the lookups but that did not stop the errors. I went to each app and tried to locate the "savedsearches" file to get a read on what is needed to generate a lookup. I could not find any of searches that generate the lookup files. I would like to know how to either produce the lookups or stop getting the errors.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>