https://community.splunk.com/t5/Getting-Data-In/After-the-Upgrade-to-7-0-3-the-inputlookup-command-not-working/m-p/457079#M100257 <P>The lookup file was working fine for long time (2 months) and contained 1000+ entries</P> <P>However, after upgrading to 7.0.3, it's not working properly. When run , most of the time throwing me errors like</P> <P><STRONG>unknown error<BR /> The search job "1532509894.27177" was canceled remotely or expired.</STRONG></P> <P>The search query when run will show that its parsing and after some time will endup with above error.</P> <P>index=wineventlog src_user!="<EM>$" EventCode=4725 user!="</EM>$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user] | stats count by user</P> <P>When tried with lookup with lesser number of entries ( 40 entries) its working fine. But when the entries in the lookup go above 400+ , im getting the error.</P> <P>Before upgrade, I was able to get the results even when i run for all time range.</P> <P>Do we have any workaround on this issue.</P> Wed, 25 Jul 2018 09:42:18 GMT renjujacob88 2018-07-25T09:42:18Z https://community.splunk.com/t5/Getting-Data-In/After-the-Upgrade-to-7-0-3-the-inputlookup-command-not-working/m-p/457079#M100257 <P>The lookup file was working fine for long time (2 months) and contained 1000+ entries</P> <P>However, after upgrading to 7.0.3, it's not working properly. When run , most of the time throwing me errors like</P> <P><STRONG>unknown error<BR /> The search job "1532509894.27177" was canceled remotely or expired.</STRONG></P> <P>The search query when run will show that its parsing and after some time will endup with above error.</P> <P>index=wineventlog src_user!="<EM>$" EventCode=4725 user!="</EM>$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user] | stats count by user</P> <P>When tried with lookup with lesser number of entries ( 40 entries) its working fine. But when the entries in the lookup go above 400+ , im getting the error.</P> <P>Before upgrade, I was able to get the results even when i run for all time range.</P> <P>Do we have any workaround on this issue.</P> Wed, 25 Jul 2018 09:42:18 GMT https://community.splunk.com/t5/Getting-Data-In/After-the-Upgrade-to-7-0-3-the-inputlookup-command-not-working/m-p/457079#M100257 renjujacob88 2018-07-25T09:42:18Z