Hello, when i search from index=alfa_cisco_ice and see the errors:
AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_ids_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.'
Please help, how too fix this problem?
And in inspector i see alot of log like
SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='cisco_dest_ipv6'.
SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='cisco_fw_connection'
i found the first problem Automatic lookups this
'LOOKUP-cisco_asa_ids_lookup'
use app TA-alfa_firepower and permited for all app i change permissions for TA-alfa_firepower only. is this good idea?