I was getting numerous errors given below on one of the SHC members,
ERROR CsvDataProvider - The lookup table 'XXXX' does not exist or is not available.
I noticed, the lookups were missing only on that particular SHC member which gave that error.
So, I did a rolling restart, hoping the members would sync, but didnt work.
Then I did -
> splunk resync shcluster-replicated-config
After running this command, I got the below error,
Failed to copy C:\Program Files\Splunk\var\run\splunk\bundle_tmp\snapshot.bundle.bcf4.tmp.untar to C:\Program Files\Splunk\etc. 18 errors occurred. Description for first 8: [{operation:"copying source to destination", error:"Access is denied.", src:"C:\Program Files\Splunk\var\run\splunk\bundle_tmp\snapshot.bundle.bcf4.tmp.untar\apps\Splunk_CiscoISE\lookups\cisco_action_lookup.csv", dest:"C:\Program Files\Splunk\etc\apps\Splunk_CiscoISE\lookups\cisco_action_lookup.csv"}
I have already checked, Splunk permissions and ensured the SYSTEM user has full rights.
This is Windows based Splunk solution.
↧
