https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349483#M3332 <P>KvStorestatus is starting for both the serach head.</P> Wed, 26 Apr 2017 08:43:28 GMT Prakhar_shukla 2017-04-26T08:43:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349477#M3326 <P>Since i upgrdaed splunk enterprise to 5.5.3 and installed Enterprise security app, i am getting following error continuously in splunkd.log.</P> <P>Failed to execute KV Store lookups: External command based lookup 'action_history_lookup' is not available because KV Store initialization has not completed yet. Please try again later.<BR /> 04-25-2017 12:27:02.312 +0200 ERROR SearchOperator:inputcsv - Error in 'inputlookup' command: External command based lookup 'correlationsearches_lookup' is not available because KV Store initialization has not completed yet. Please try again later.</P> <P>and some other failed external commands.</P> Tue, 29 Sep 2020 13:49:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349477#M3326 Prakhar_shukla 2020-09-29T13:49:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349478#M3327 <P>Do you see anything that may indicate problems with MongoDB? You can see the logs with the following search:</P> <PRE><CODE>index=_internal sourcetype=mongod </CODE></PRE> Tue, 25 Apr 2017 17:44:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349478#M3327 LukeMurphey 2017-04-25T17:44:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349479#M3328 <P>it seems normal. Error is coming since i upgraded Enterprise and installed ES</P> <P>04-26-2017 09:06:02.289 +0200 ERROR KVStoreLookup - Failed to create lookup context<BR /> 04-26-2017 09:06:02.289 +0200 ERROR SearchOperator:inputcsv - Error in 'inputlookup' command: External command based lookup 'correlationsearches_lookup' is not available because KV Store initialization has not completed yet. Please try again later.</P> Wed, 26 Apr 2017 07:06:35 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349479#M3328 Prakhar_shukla 2017-04-26T07:06:35Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349480#M3329 <P>Give it sometime to run datamodels and lookup builds to complete. </P> Wed, 26 Apr 2017 07:12:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349480#M3329 krish3 2017-04-26T07:12:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349481#M3330 <P>its been 3 days, after installation i did nothing in ES or splunk</P> Wed, 26 Apr 2017 07:18:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349481#M3330 Prakhar_shukla 2017-04-26T07:18:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349482#M3331 <P>Try running this search and post the output:</P> <PRE><CODE>|rest /services/server/info|table host kvStoreStatus </CODE></PRE> Wed, 26 Apr 2017 08:35:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349482#M3331 krish3 2017-04-26T08:35:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349483#M3332 <P>KvStorestatus is starting for both the serach head.</P> Wed, 26 Apr 2017 08:43:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349483#M3332 Prakhar_shukla 2017-04-26T08:43:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349484#M3333 <P>Did you have a look at this <A href="https://answers.splunk.com/answers/457893/after-upgrading-to-650-kv-store-will-not-start.html">case</A> and check for permission for KVstore files &amp; certificates?</P> <P>The status of KVstore should be "ready".</P> Wed, 26 Apr 2017 08:52:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349484#M3333 krish3 2017-04-26T08:52:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349485#M3334 <P>i have upgraded the splunk ES version to 4.7 and it seems to fixed the issue</P> Wed, 26 Apr 2017 12:23:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Failed-to-execute-KV-Store-lookup/m-p/349485#M3334 Prakhar_shukla 2017-04-26T12:23:19Z