I am on Splunk 7.3.3 and I installed the Palo Alto TA on the SH, FH, and IDX for field parsing.
The TA works but I am getting the following errors:
6 errors occurred while the search was executing. Therefore, search results might be incomplete
Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup
I only see these lookups under automatic lookups.
I am using Palo Alto TA add on 6.2.0.
I am not using the MineMeld Palo feature, so I am looking for a way to disable it and stop the errors.
Any advice is appreciated.
Thank you.
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
try commenting out line 125, 126 173, 174 from props.conf in Splunk_TA_paloalto. This answer works as of version 6.2.0 of the add-on.
fn awsome panguy!!! I cannot believe I missed that... problem solved...
Please convert to an answer, and if I had more points I would give you more...
Have you tried disabling the automatic lookups from the "Lookups" setting page?
there is no option to do that from the UI, I tried commenting them out but still get the error...
Sorry, I didn't realize there is no option to disable it from the GUI. Commenting it out should work. Did you restart the instances?
what lines did you comment out? I'm assuming your commenting props.conf
we tried everything, disabled replication in collections.conf, props, transforms, everywhere, but if you know what to comment specifically I can go thru it again?
yes but still no luck, the only thing that stops the errors is disabling the app...
its referencing the indexer could not load the lookup = LOOKUP-minemeldfeeds_dest_lookup etc,
do you know if there is a way to create what is missing somewhere?