About sean_wong

sean_wong · ‎08-11-2021

I have the same problem on my Splunk search head version 8.2.1 and it was resolved after the completion of below steps. Error Messages: - "Cannot expand lookup field 'action' due to a reference cycle in the lookup configuration. Check search .log for details and update the lookup configuration to remove the reference cycle." 1. Log onto search head by putty, run below command. $SPLUNK_HOME/splunk btool props list --debug | grep -E 'LOOKUP.*\saction\s.*\saction\s' Result:- /opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/props.conf LOOKUP-cisco_asa_action_lookup_1 = cisco_asa_action_lookup vendor_action as action OUTPUT action, action AS Cisco_ASA_action 2. Log onto to search head on web browser 3. Go to `Settings` - `Lookups` - `Automatic lookups`. 4. Look for a lookup named as `LOOKUP-cisco_asa_action_lookup_1`. p.s. The captured screen is showing the last result (problem was solved). I have not regenerate the problem, please treat it as an example. 5. Click on 'cisco:asa : LOOKUP-cisco_asa_action_lookup_1'. 6. Upon opening the lookup in lookup editor, click `Save` without touching any field. 7. Repeat the steps`1.` to `4.` if there is another lookup has same issue. 8. After the above, run the command again and the new lookups should look like as followings. /opt/splunk/etc/apps/Splunk_TA_cisco-asa/local/props.conf LOOKUP-cisco_asa_action_lookup_1 = cisco_asa_action_lookup vendor_action AS action OUTPUT action AS Cisco_ASA_action 9. Restart the search head once and see whether the problem is solved. Sean Wong

sean_wong · ‎05-29-2020

Hi, Can you described more about "uploading and installing new add-on"? I tried to uploaded and re-install Splunk_TA_microsoft-cloudservices but the problem is still occurs. Can you advise how to fix it? Thanks.

sean_wong · ‎05-28-2019

Hi Folks, I found some messages were show "Invalid key in stanza..." when we restarted the Splunk service (with Splunk Enterprise Essential). I am appreciate if anyone told me how to fix it? Thanks. [splunk@splunksh01 bin]$ ./splunk start Splunk> The Notorious B.I.G. D.A.T.A. Checking prerequisites... Checking http port [8000]: open Checking mgmt port [8089]: open Checking appserver port [127.0.0.1:8065]: open Checking kvstore port [8191]: open Checking configuration... Done. Checking critical directories... Done Checking indexes... Validated: _audit _internal _introspection _telemetry _thefishbucket access_center_summary access_summary access_summary2 apache audit_summary audit_summary2 bigip bro cim_modactions cim_summary endpoint_summary endpoint_summary2 firedalerts history ioc ipa main main1 mcafee msad network_summary network_summary2 network_summary3 notable notable_summary oracle os pci pci_posture_summary pci_re q6_summary pci_summary pcios perfmon proxy_center_summary proxy_center_summary2 reportsummary risk session_end session_start snipnet soph os sos sos_summary_daily summary symantec sysmon threat_activity tomcat traffic_center_summary traffic_center_summary2 ubaroute ueba webl ogic websense whois windows wineventlog winevents xtreme_contexts Done Bypassing local license checks since this instance is configured with a remote license master. Checking filesystem compatibility... Done Checking conf files for problems... Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 17: display.visualizations.custom.sankey_diagram_app.sankey_diagram.showBackwards (value: 0). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 18: display.visualizations.custom.sankey_diagram_app.sankey_diagram.showLabels (value: 1). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 19: display.visualizations.custom.sankey_diagram_app.sankey_diagram.showLegend (value: 1). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 20: display.visualizations.custom.sankey_diagram_app.sankey_diagram.showSelf (value: 0). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 21: display.visualizations.custom.sankey_diagram_app.sankey_diagram.showTooltip (value: 1). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 22: display.visualizations.custom.sankey_diagram_app.sankey_diagram.styleBackwards (value: 0). Invalid key in stanza [Generate MITRE matrix list] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/savedsearch es.conf, line 23: display.visualizations.custom.sankey_diagram_app.sankey_diagram.useColors (value: 1). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --deb ug' Done Checking default conf files for edits... Validating installed files against hashes from '/opt/splunk/splunk-7.1.1-8f0ead9ec3db-linux-2.6-x86_64-manifest' All installed files intact. Done All preliminary checks passed. Starting splunk server daemon (splunkd)... Done [ OK ] Waiting for web server at https://127.0.0.1:8000 to be available........................... Done If you get stuck, we're here to help. Look for answers here: http://docs.splunk.com The Splunk web interface is at https://splunksh01.splunk.com:8000

Posts	3
Solutions	0
Karma Given	7
Karma Received	17
Member Since	‎05-28-2019

Online Status	Offline
Date Last Visited	‎12-09-2021 09:06 PM

Splunk ES show messages "Invalid key in stanza" wh...

Re: Cannot expand lookup field due to a reference ...

Re: Unable to initialize modular input "mscs_stora...

Splunk ES show messages "Invalid key in stanza" wh...