Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file

LearningGuy — Fri, 10 Nov 2023 03:24:19 GMT

Hello,

I received the following error, the issue resolved itself after 4 hours. The CSV file size is 54 MB.
Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file:
'opt/splunk/var/run/searchpeers/[random number]/apps/[app-name]/lookups/test.csv'

I am aware that there already a post in regards this, but I have more questions
1) What is the cause of this error?
Is it because of the bug like mentioned in the old post below? I am running 9.0.4, the bug should have been fixed
https://community.splunk.com/t5/Splunk-Enterprise/Message-quot-Streamed-search-execute-failed-because-Error-in/m-p/569878

2) a) Is it because max_memtable_bytes in limits.conf is 25MB?
https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf

b) How do I check limit.conf via GUI without admin role?

c) What does "Lookup files with size above max_memtable_bytes will be indexed on disk" mean?
Is it a good thing or bad?

d) If I see cs.index.alive file auto generated, does it mean it's an indexed on disk?
[random number]/apps/[app-name]/lookups/test.csv
[random number]/apps/[app-name]/lookups/test.csv_[random number].cs.index.alive

3) If I am not allowed to change any setting (increase 25MB limit),
what is the solution for this issue?

I appreciate your help. Thank you

topic Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file in Splunk Enterprise

Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file