uberAgent

Workaround for Lookup Errors with Splunk Free

On Splunk Free, uberAgent cannot automatically generate needed lookup tables. Because of the missing lookup tables, the following or similar error messages are displayed on many dashboards:

  • No results found
  • The lookup table lookup_appnameidmapping does not exist. It is referenced by configuration uberAgent:Process:NetworkTargetPerformance.
  • The lookup table lookup_appnameidmapping does not exist. It is referenced by configuration uberAgent:Process:ProcessDetail.
  • The lookup table lookup_appnameidmapping does not exist. It is referenced by configuration uberAgent:Process:ProcessStartup.

See this article for details and for information on officially supported versions.

Workaround

As a workaround, the lookup tables can be generated manually. To do that run slightly modified searches from uberAgent’s savedsearches.conf.

One of the original searches:

index=`uberAgent_index` sourcetype=uberAgent:Application:AppNameIdMapping AppId=* AppName=* | stats latest(_time) as _time mode(AppName) as AppName by AppId | inputlookup append=t lookup_appnameidmapping | stats latest(_time) as _time latest(AppName) as AppName by AppId | eval TimeDelta=now()-_time | search TimeDelta<31536000 | fields AppName AppId _time

We simply append the outputlookup command to have Splunk create the lookup tables. The full searches look like this:

index=`uberAgent_index` sourcetype=uberAgent:Application:AppNameIdMapping AppId=* AppName=* | stats latest(_time) as _time mode(AppName) as AppName by AppId | inputlookup append=t lookup_appnameidmapping | stats latest(_time) as _time latest(AppName) as AppName by AppId | eval TimeDelta=now()-_time | search TimeDelta<31536000 | fields AppName AppId _time | outputlookup lookup_appnameidmapping

index=`uberAgent_index` (sourcetype=uberAgent:System:MachineInventory OR sourcetype=uberAgent:System:NetworkConfigInformation) OsVersion=* | stats latest(_time) as _time latest(OsVersion) as OsVersion latest(OsBuild) as OsBuild latest(OsType) as OsType latest(AdDomainDns) as AdDomainDns latest(AdSite) as AdSite latest(AdOu) as AdOu latest(CtxFarmName) as CtxFarmName latest(CtxMachineCatalogName) as CtxMachineCatalogName latest(CtxDeliveryGroupName) as CtxDeliveryGroupName latest(HwManufacturer) as HwManufacturer latest(HwModel) as HwModel values(NetworkConfigIPv4) as NetworkConfigIPv4 by host | inputlookup append=t lookup_hostinfo | fields - Ipv4Address | stats latest(_time) as _time latest(OsVersion) as OsVersion latest(OsBuild) as OsBuild latest(OsType) as OsType latest(AdDomainDns) as AdDomainDns latest(AdSite) as AdSite latest(AdOu) as AdOu latest(CtxFarmName) as CtxFarmName latest(CtxMachineCatalogName) as CtxMachineCatalogName latest(CtxDeliveryGroupName) as CtxDeliveryGroupName latest(HwManufacturer) as HwManufacturer latest(HwModel) as HwModel values(NetworkConfigIPv4) as Ipv4Address by host | eval TimeDelta=now()-_time | search TimeDelta<31536000 | fields host OsVersion OsBuild OsType AdDomainDns AdSite AdOu CtxFarmName CtxMachineCatalogName CtxDeliveryGroupName HwManufacturer HwModel Ipv4Address _time | outputlookup lookup_hostinfo

index=`uberAgent_index` sourcetype=uberAgent:System:MachineInventory RAMSizeGB=* | stats latest(_time) as _time latest(RAMSizeGB) as RAMSizeGB latest(IsBatteryPresent) as IsBatteryPresent latest(CPUName) as CPUName latest(CPUSockets) as CPUSockets latest(CPUCoresPhysical) as CPUCoresPhysical latest(CPUCoresLogical) as CPUCoresLogical latest(CPUMaxMhz) as CPUMaxMhz latest(HwIsVirtualMachine) as HwIsVirtualMachine latest(OsUpdateBuildRevision) as OsUpdateBuildRevision by host | inputlookup append=t lookup_hostinfo2 | stats latest(_time) as _time latest(RAMSizeGB) as RAMSizeGB latest(IsBatteryPresent) as IsBatteryPresent latest(CPUName) as CPUName latest(CPUSockets) as CPUSockets latest(CPUCoresPhysical) as CPUCoresPhysical latest(CPUCoresLogical) as CPUCoresLogical latest(CPUMaxMhz) as CPUMaxMhz latest(HwIsVirtualMachine) as HwIsVirtualMachine latest(OsUpdateBuildRevision) as OsUpdateBuildRevision by host | eval TimeDelta=now()-_time | search TimeDelta<31536000 | fields host RAMSizeGB IsBatteryPresent CPUName CPUSockets CPUCoresPhysical CPUCoresLogical CPUMaxMhz HwIsVirtualMachine OsUpdateBuildRevision _time | outputlookup lookup_hostinfo2

| pivot uberAgent Process_ProcessStartup latest(_time) as LastSeen splitrow ProcName | eval ProcName = lower (ProcName) | inputlookup append=t lookup_processstartup_processlist | stats first(LastSeen) as LastSeen by ProcName | eval LastSeen = round (strptime (LastSeen, "%Y-%m-%dT%H:%M:%S.%Q%z"), 0) | eval TimeDelta=now()-LastSeen | search TimeDelta<31536000 | fields ProcName LastSeen | outputlookup lookup_processstartup_processlist

| pivot uberAgent Process_NetworkTargetPerformance latest(_time) as LastSeen splitrow NetTargetRemoteNameAddress | eval ProcName = lower (NetTargetRemoteNameAddress) | inputlookup append=t lookup_networktargetperformance_targetlist | stats first(LastSeen) as LastSeen by NetTargetRemoteNameAddress | eval LastSeen = round (strptime (LastSeen, "%Y-%m-%dT%H:%M:%S.%Q%z"), 0) | eval TimeDelta=now()-LastSeen | search TimeDelta<31536000 | fields NetTargetRemoteNameAddress LastSeen | outputlookup lookup_networktargetperformance_targetlist

Run these searches over a longer time range (e.g. last seven days) to capture among other things mappings for applications that are run only infrequently, too.

After running one of the full searches Splunk might display error messages like "Could not write to file 'lookup_appnameidmapping': Failed to move file to final destination." However, we found that it still creates all output files successfully.

Workaround for Lookup Errors with Splunk Free