Knowledge Management

Cleaned kvstore and need to recreate kvstore lookup

martinnepolean
Explorer

We ran kvstore clean command without a backup and looking for a way to restore it. We particularly want to recreate one lookup(minemeldfeeds_lookup) which comes with Palo Alto Networks, version -6.2.0. Please let us know if there is a way to do it

Below is the lookup  error

Error in 'lookup' command: Could not construct lookup 'minemeldfeeds_lookup, indicator, AS, client_ip, OUTPUT, value.autofocus_tags, AS, client_autofocus_tags'. 

Labels (2)
0 Karma

anilchaithu
Builder

@martinnepolean 

I assume yours is not a shcluster set up.

Are you able to identify the search that generated this collection minemeldfeeds_lookup?

You can re-run this search for longer times to build the collection again. 

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...