Hello Splunkers,
I keep getting the error message "Could not load lookup=LOOKUP-app_proto" in multiple apps on multiple dashboards. I have checked settings and neither the lookup file or definition existed and I can't figure out what is asking for this lookup. I can't find a reference to a lookup by that name in any documentation or on any of the Splunk sites. I have created a lookup with a matching name but I don't know where to put it. I added it to the search app but I still got the error, then I added it to an app getting the error and that didn't work either. Basic system info is below, let me know what other info you would like and I will provide it as soon as I can. Thanks for reading.
Stand-alone Splunk Enterprise
Version: 7.3.0
Build: 657388c7a488
CIM: 4.13.0
Apps: (Not all apps listed)
InfoSec App for Splunk (getting error on some dashboards)
Network Traffic App for Splunk (not getting the error)
Cisco Security Suite (getting error on all dashboards)
Obelisk Threat Intel (getting error on all "Splash" page dashboards)
Splunk Security Essentials (getting error on "app awareness" dashboards)
Splunk Stream (getting error on all informational dashboards)
Firegen for Cisco ASA (getting error on all summary page dashboards)
Cisco Firepower App for Splunk (getting error on all default dashboards)
↧