Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Distributed Searches and Lookup table errors.

$
0
0

I am having a problem with lookup tables in a distributed search environment. The lookup table is working on the main search head but I receive the below error on the secondary Linux instance.

  1. [Linux_Instance] The lookup table 'Windows_EventCode_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.
  2. [Linux_Instance] The lookup table 'W2K3_Logon_Type_Lookup' does not exist. It is referenced by configuration 'WMI:WinEventLog:Security'.

The search head is a Windows systems the error is from the Linux Splunk system. I do have export=system setup on both systems and I have created the lookup on the Linux Splunk instance but it still gives me the above error.


Viewing all articles
Browse latest Browse all 13053

Trending Articles