Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: Palo Alto Networks Add-on: How to stop "mineme...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am on Splunk 7.3.3 and I installed the Palo Alto TA on the SH, FH, and IDX for field parsing.
The TA works but I am getting the following errors:
6 errors occurred while the search was executing. Therefore, search results might be incomplete
Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup
I only see these lookups under automatic lookups.
I am using Palo Alto TA add on 6.2.0.
I am not using the MineMeld Palo feature, so I am looking for a way to disable it and stop the errors.
Any advice is appreciated.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fn awsome panguy!!! I cannot believe I missed that... problem solved...
Please convert to an answer, and if I had more points I would give you more...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried disabling the automatic lookups from the "Lookups" setting page?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
there is no option to do that from the UI, I tried commenting them out but still get the error...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I didn't realize there is no option to disable it from the GUI. Commenting it out should work. Did you restart the instances?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what lines did you comment out? I'm assuming your commenting props.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
we tried everything, disabled replication in collections.conf, props, transforms, everywhere, but if you know what to comment specifically I can go thru it again?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes but still no luck, the only thing that stops the errors is disabling the app...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
its referencing the indexer could not load the lookup = LOOKUP-minemeldfeeds_dest_lookup etc,
do you know if there is a way to create what is missing somewhere?
Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data
Your summer travels continue with new course releases
From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...
