Installation

Why do I get the following error after upgrading Splunk to 7.2?

graju89
Path Finder

I get the following error after upgrading to Splunk 7.2.

The error is:

Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup

I have only upgraded my search head. Other instances are running 6.6.6.

Can anyone can help me?

Tags (1)
0 Karma
1 Solution

graju89
Path Finder

If anyone having same issue.

The problem was fixed by downgrading splunk to 7.1.1. Probably splunk PAN add-on(6.0.2) is not compatible with splunk7.2. I havent tried upgrading PAN add-on to 6.1.0 though.

View solution in original post

0 Karma

Rob2520
Communicator
0 Karma

graju89
Path Finder

If anyone having same issue.

The problem was fixed by downgrading splunk to 7.1.1. Probably splunk PAN add-on(6.0.2) is not compatible with splunk7.2. I havent tried upgrading PAN add-on to 6.1.0 though.

0 Karma

vinkumar_splunk
Splunk Employee
Splunk Employee

This lookup comes from Palo Alto app, check whether the below link is helpful. Check app compatibility as well.

https://answers.splunk.com/answers/590248/error-at-search-time-after-upgrading-palo-alto-net-1.html

0 Karma

graju89
Path Finder

@vinkumar_splunk I tried that. Still no luck. And the add-on has no compatibility issue.

0 Karma

graju89
Path Finder

Also, search peers are reporting this error
The 'minemeldfeeds_lookup' KV Store lookup table is empty or has not yet been replicated to the search peer.
I dont know why it is reporting after I upgrade. search peers are running 6.6.6 and search head is running 7.2.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...