Activity Feed
- Posted Re: Could not load lookup=LOOKUP-record_type on Splunk Enterprise. 09-04-2024 11:00 AM
- Posted Re: Could not load lookup=LOOKUP-record_type on Splunk Enterprise. 09-04-2024 10:59 AM
- Posted Re: Could not load lookup=LOOKUP-record_type on Splunk Enterprise. 09-04-2024 10:57 AM
- Posted Could not load lookup=LOOKUP-record_type on Splunk Enterprise. 09-04-2024 10:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
09-04-2024
10:59 AM
In Splunk_TA_microsoft_sysmon\default\app.conf or Splunk_TA_microsoft_sysmon\local\app.conf add the following then deploy the SHC bundle [shclustering] deployer_lookups_push_mode = always_overwrite In the app.conf seems the best way for the sysmon TA
... View more
09-04-2024
10:57 AM
the -preserve-lookups true option when we did the SHC bundle push and the add-on's 3.x version of the lookup had a different field name (record_type ) vs the version in 4.x which is record_type_id.
... View more
09-04-2024
10:56 AM
WE updated the Sysmon add-on from 3.x to 4.0.1 (latest) on a search head cluster. After, we're getting errors about how the node we're on and the indexers can't load a lookup (Could not load lookup=LOOKUP-record_type).
... View more
Labels
- Labels:
-
administration
