Knowledge Management

Cleaned kvstore and need to recreate kvstore lookup

martinnepolean
Explorer

We ran kvstore clean command without a backup and looking for a way to restore it. We particularly want to recreate one lookup(minemeldfeeds_lookup) which comes with Palo Alto Networks, version -6.2.0. Please let us know if there is a way to do it

Below is the lookup  error

Error in 'lookup' command: Could not construct lookup 'minemeldfeeds_lookup, indicator, AS, client_ip, OUTPUT, value.autofocus_tags, AS, client_autofocus_tags'. 

Labels (2)
0 Karma

anilchaithu
Builder

@martinnepolean 

I assume yours is not a shcluster set up.

Are you able to identify the search that generated this collection minemeldfeeds_lookup?

You can re-run this search for longer times to build the collection again. 

 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...