Refine your search:

Lookup table does not exist error on update to 4.1

1

Since I updated our server to 4.1.2 I'm seeing the following error with most searches.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WinEventLog...'.

The lookup table 'sid_lookup' does not exist. It is referenced by configuration 'source::WMI:WinEventLog...'.

I tried to export lookups as mentioned in this answer, but I think the actual file paths are missing. I think I might need to install a newer version of the Splunk for Windows app? My server is running on Linux.

asked 19 May '10, 20:05

Yancy's gravatar image

Yancy
396●1●14
accept rate: 37%

One Answer:
oldestnewestmost voted
2

Installing a newer Windows app it's a good idea. The sid_lookup tables were initially created to try and map SID strings in Windows Event Logs with the respective objects. That method of mapping is not used anymore, instead the mapping happens at the time when the logs are pulled from the machine.

link

answered 19 May '10, 20:35

Ledio%20Ago's gravatar image

Ledio Ago ♦
649●2●4●13
accept rate: 33%

Thanks Ledio, that resolved the issue for me.

(19 May '10, 23:05) Yancy
Post your answer
toggle preview

Copyright © 2005-2012 Splunk, Inc. All rights reserved.