topic Re: Has anyone encountered this error: Asset and Identity Management issue? in Security

Has anyone encountered this error: Asset and Identity Management issue?

Paaattt — Wed, 21 Sep 2022 14:09:24 GMT

Has anyone encountered this issue and how did you fixed it on Splunkcloud and Enterprise Security "Identity: An error occurred while the Asset and Identity Management modular input ran" ? When I checked the error it is saying that Lookup file error, unknown path or update time. Pretty sure lookups is existing but I am not sure what it means by update time?

Re: Asset and Identity Management issue

rav_diesel — Wed, 21 Sep 2022 13:47:48 GMT

In the same boat as you, have you figured this out? By the way, I switched over to SA-CrowdStrike with CrowdStrike Device TA and use it to build an asset tables. @Paaattt

Re: Has anyone encountered this error: Asset and Identity Management issue?

anel — Tue, 09 May 2023 12:12:41 GMT

Any updates?

Re: Has anyone encountered this error: Asset and Identity Management issue?

hettervik — Fri, 11 Aug 2023 07:04:05 GMT

Has anyone found the reason for this error message yet, and how to fix it?

We're encountering the same error. Both the lookup file and the lookup definition surely exists, and both are available when using inputlookup in the search bar. Also we've checked that they are available in the Splunk ES app. The identity list in Splunk ES does populate with data, so the "identity lookup merging searches" are in fact working, meaning that surely the "lookup file path exists" and is available for Splunk ES.

Re: Has anyone encountered this error: Asset and Identity Management issue?

hettervik — Wed, 30 Aug 2023 09:00:29 GMT

We've looked a bit more into this case. The error is coming from the script "identity_manager.py" in the app "SA-IdentityManagement". The error is generated in the following "for" loop.

for url, path, size, last_updated in update_times:
  if path and last_updated:
    lookup[url] = last_updated
  else:
    logger.error('status="Lookup file error, unknown path or update time" name=%s', url)

The "update_times" array comes from the method "get_lookup_table_file_update_times", which again comes ultimately from the Python package "importlib.util.spec_from_file_location". We were thinking that this error might be from this package, and not from Splunk per se, but when we look at the actual lookup file CSV in the Linux OS, it is there and has the last modified time value sat, so that is not the cause either.

So, still haven't figured this out.

Re: Has anyone encountered this error: Asset and Identity Management issue?

ZachTheSplunkr — Mon, 23 Oct 2023 16:01:50 GMT

This error exists since the KVstore is being used as opposed to a CSV file and does not interfere with the functionality of lookup creation.

See the known issue at: https://splunk-sa-crowdstrike.ztsplunker.com/releases/issues/

Re: Has anyone encountered this error: Asset and Identity Management issue?

lalithasegu — Thu, 02 Oct 2025 13:41:58 GMT

Does anyone come across this error "file=identity_manager.py:lookup_last_update:391 | status="Lookup file error, unknown path or update time"?

Please help me.

Re: Has anyone encountered this error: Asset and Identity Management issue?

lalithasegu — Thu, 02 Oct 2025 13:42:50 GMT

In case if you find solution for this. please share it with me. really helpful.