Category: Problem | Priority: Critical |
|---|---|
Platform: Splunk Cloud | Version: 1 from 10.03.2023 |
Description
Among other issues, the source/system lookup does not populate on PowerConnect App for Splunk dashboards in Splunk Cloud.
Cause
The Master Inventory Lookup is KVstore based. A Splunk Cloud bug is causing the supported fields list in the lookup definition to be misinterpreted, resulting in the lookup showing no results in search despite data being present in the underlying KV collection.
Resolution
As a temporary workaround, this lookup should be converted to a CSV file-based lookup:
Created a new CSV lookup called master_inventory_lookup.csv. Ensure that it is blank.
Go to Settings → Lookups → Lookup Definitions
Search for and open the master_inventory_lookup definition under the SAP PowerConnect for Splunk app.
Change the definition Type to file-based.
In the Lookup file, set the value to master_inventory_lookup.csv.
Save the lookup definition.
In the PowerConnect app, go to Settings → Searches, reports, and alerts
Search “Master Inventory Lookup” and find the “Master Inventory Lookup - Lookup Gen - Run Once Only” search.
Run this search.