Why do I get the following error after upgrading Splunk to 7.2?

[graju89]

I get the following error after upgrading to Splunk 7.2.

The error is:

Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup

I have only upgraded my search head. Other instances are running 6.6.6.

Can anyone can help me?

[Rob2520]

Check this accepted answer https://answers.splunk.com/answers/703136/minemeld-lookup-errors-after-upgrading-splunk-to-7.html

[graju89 · Accepted solution]

If anyone having same issue.

The problem was fixed by downgrading splunk to 7.1.1. Probably splunk PAN add-on(6.0.2) is not compatible with splunk7.2. I havent tried upgrading PAN add-on to 6.1.0 though.

[vinkumar_splunk]

This lookup comes from Palo Alto app, check whether the below link is helpful. Check app compatibility as well.

https://answers.splunk.com/answers/590248/error-at-search-time-after-upgrading-palo-alto-net-1.html

[graju89]

@vinkumar_splunk I tried that. Still no luck. And the add-on has no compatibility issue.

[graju89]

Also, search peers are reporting this error
The 'minemeldfeeds_lookup' KV Store lookup table is empty or has not yet been replicated to the search peer.
I dont know why it is reporting after I upgrade. search peers are running 6.6.6 and search head is running 7.2.