Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Why do I get the following error after upgrading S...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I get the following error after upgrading to Splunk 7.2.
The error is:
Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup
I have only upgraded my search head. Other instances are running 6.6.6.
Can anyone can help me?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If anyone having same issue.
The problem was fixed by downgrading splunk to 7.1.1. Probably splunk PAN add-on(6.0.2) is not compatible with splunk7.2. I havent tried upgrading PAN add-on to 6.1.0 though.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check this accepted answer https://answers.splunk.com/answers/703136/minemeld-lookup-errors-after-upgrading-splunk-to-7.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If anyone having same issue.
The problem was fixed by downgrading splunk to 7.1.1. Probably splunk PAN add-on(6.0.2) is not compatible with splunk7.2. I havent tried upgrading PAN add-on to 6.1.0 though.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This lookup comes from Palo Alto app, check whether the below link is helpful. Check app compatibility as well.
https://answers.splunk.com/answers/590248/error-at-search-time-after-upgrading-palo-alto-net-1.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@vinkumar_splunk I tried that. Still no luck. And the add-on has no compatibility issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, search peers are reporting this error
The 'minemeldfeeds_lookup' KV Store lookup table is empty or has not yet been replicated to the search peer.
I dont know why it is reporting after I upgrade. search peers are running 6.6.6 and search head is running 7.2.
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
