topic Re: Why is my dashboard giving error for only one lookup ? in Splunk Search

Why is my dashboard giving error for only one lookup ?

ramarcsight — Tue, 09 Oct 2018 12:54:51 GMT

Hello Everyone
I have a dashboard and when i ran it, it gave the following error:

[IDX01] Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

[IDX02]Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

It gave the error for all the indexers.

original search :

index=foo 
  | lookup device_lookup device_id as id OUTPUT device_ip
  | fields device_ip , orgDeviceName
  | stats count by device_ip

but when i run

| inputlookup device_lookup

It works fine.

weirdly all other lookups run without local=true. However, only this particular lookup gives error when the search job is run
as

[IDX02]Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

Please advise

Re: Why is my dashboard giving error for only one lookup ?

Vijeta — Tue, 09 Oct 2018 14:32:35 GMT

Is it a KV-store lookup ? Are all other lookups similar type or csv lookups?

Re: Why is my dashboard giving error for only one lookup ?

ramarcsight — Tue, 09 Oct 2018 14:49:23 GMT

All are kvstore only

Re: Why is my dashboard giving error for only one lookup ?

bishtk — Wed, 02 Dec 2020 04:11:31 GMT

Hi @ramarcsight , I know its pretty old but just wanted to check if by any chance did you manage to resolve it? As I am facing similar issue now post upgrading environment to 8.1.X

-Thanks

Re: Why is my dashboard giving error for only one lookup ?

Laszlo_K — Mon, 01 Feb 2021 16:57:24 GMT

Hi @bishtk @ramarcsight

Had the same "Failed to re-open lookup file" issue with few KVStore lookups.

Re: Why is my dashboard giving error for only one lookup ?

dmadeira_splunk — Thu, 23 Sep 2021 10:08:02 GMT

This might help

https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/Fixedissues