topic Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup in Dashboards & Visualizations

Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

Varsha1 — Mon, 19 Dec 2022 12:26:47 GMT

Hi All,

I'm facing issue while appending results for 2 searches using append command.

I have a 2 search which i'm using to get results and also both query has lookup command to get ip_address details from a lookup .

Both searches are almost same except "filter" field and eval commands. And i'm using append command to append results as below:

I'm getting error ([subsearch]: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup) when running above query and runs fine if i run it seperately.

Please let me know what i am making wrong.

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

ITWhisperer — Mon, 19 Dec 2022 13:38:04 GMT

Subsearches are limited to 50,000 events. Could this be your issue? Could you try with smaller timeframes?

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

Varsha1 — Mon, 19 Dec 2022 13:46:37 GMT

I'm running it for last 60min and it is below 50000 events only

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

richgalloway — Mon, 19 Dec 2022 14:39:26 GMT

Consider moving the lookup command to after the append.

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

starcher — Mon, 19 Dec 2022 15:36:19 GMT

Most often that message happens when the csv behind the lookup definition is missing. Check that.

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

Varsha1 — Mon, 19 Dec 2022 16:42:04 GMT

@richgalloway , It is working fine when i used it at the end. can you explain the logic behind it please.

Thank you so much for the answer !!

Re: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

richgalloway — Mon, 19 Dec 2022 17:25:37 GMT

I wish I had an explanation. You'd have to look at the search log for the failing search to see how that error is triggered.

Moving the lookup call was mainly a shot in the dark, but also should be more efficient by doing the lookups after the number of events have been reduced by stats.