topic Re: 'outputlookup' command: Could not write to file in Splunk Search

'outputlookup' command: Could not write to file

Lowell — Thu, 01 Jul 2010 04:37:55 GMT

I'm trying to use outputlookup to generate a lookup table based on search results and I'm running into the following error:

Error in 'outputlookup' command: Could not write to file 'metrics_daily_sourcetype.csv'.

I've tried both both a simple csv file, an absolute path, as well as a named lookup (stanza name in transforms.conf).

Then I looked in the search.log for search job and found the following error messages:

06-30-2010 17:24:09.122 ERROR SearchResults - Unable to write to file '/opt/splunk/etc/apps/SplunkAdmin/lookups/metrics_daily_sourcetype.csv'.  Retried 5 times, period=500 ms. error='Invalid cross-device link'
06-30-2010 17:24:09.122 ERROR outputcsv - Error in 'outputlookup' command: Could not write to file 'metrics_daily_sourcetype.csv'.

My $SPLUNK_HOME and $SPLUNK_HOME/var/run are on a different file system. And I'm wondering if that has anything to do with the issue. (I ran into an issue with this before with summary indexing. The stash file was written to a temp file under $SPLUNK_HOME/var/run and the process assumed it could do a "rename" (which is atomic) rather than doing a move which is needed when you have multiple partitions. So I'm wondering if something similar is going on here.)

Any ideas?

I'm running Splunk 4.1.3 on Ubuntu Linux 8.04 (32 bit)

Workaround:

I'm temporarily working around this issue by using outputcsv and then manually coping my file from $SPLUNK_HOME/var/run/splunk/table.csv to $SPLUNK_HOME/etc/apps/SplunkAdmin/lookups/. But this is rather tedious.

Re: 'outputlookup' command: Could not write to file

ftk — Thu, 01 Jul 2010 04:51:57 GMT

There is a open defect ticket on this -- not sure what the ticket number is but as I was troubleshooting a similar issue people in IRC noted that this is an open issue.

Re: 'outputlookup' command: Could not write to file

ftk — Thu, 01 Jul 2010 04:56:07 GMT

ACtually found the defect in an email it's SPL-31130

Re: 'outputlookup' command: Could not write to file

ftk — Thu, 01 Jul 2010 04:57:33 GMT

This seems to be related to SPL-31130 -- output file located on a different file system.

Re: 'outputlookup' command: Could not write to file

Lowell — Thu, 01 Jul 2010 05:04:17 GMT

Thanks. I've emailed support asking to be included on this issue.

Re: 'outputlookup' command: Could not write to file

jpass — Sun, 14 Oct 2012 02:11:02 GMT

were you able to fix the issue? If so, how did you do it?

Re: 'outputlookup' command: Could not write to file

Rob — Sat, 27 Oct 2012 00:52:04 GMT

This issue should be fixed with Splunk version 4.1.4+

Re: 'outputlookup' command: Could not write to file

bharrell — Tue, 12 Sep 2017 22:28:20 GMT

Ran into this error today. In my case, I had the CSV file open in Excel - causing a write lock.