Receiving Error when trying to use Third Man.

[aracer]

Does anybody have any idea on what is causing the following error?

Error in 'lookup' command: Error using lookup table 'tm_asn': CIDR and wildcard matching is restricted to lookup files under the in-memory size limit.

[Richfez · Accepted solution]

Reading the error message, I think what it's saying is that your lookup you are trying to use is too big to use CIDR matching on. I'm not 100% positive, but I believe you might resolve this by bumping up some settings in your limits.conf file. Specifically, look down in the [section limits and notice this section...

max_memtable_bytes = <integer>
* Maximum size, in bytes, of static lookup file to use an in-memory index for.
* Lookup files with size above max_memtable_bytes will be indexed on disk
* A large value results in loading large lookup files in memory leading to bigger 
  process memory footprint.
* Caution must be exercised when setting this parameter to arbitrarily high values!
* Default: 10000000 (10MB)

That second bullet point describes what I think is your issue. The amount of memory a lookup table is allowed to have is X, but this lookup table is sized X+Y, so it's too big and stays on disk. Because it's on disk, certain types of matching (CIDR and wildcard matching) aren't allowed.

So give that setting a shot, see what it gets you! Maybe try doubling it - or add 10 MB at a time until the problem goes away.

Happy Splunking,
Rich

[Richfez]

aracer,

If the above setting worked, could you mark this answer as Accepted?

If not, please write back with more information and we'll continue to help!

Happy Splunking,
Rich

[scc00]

That worked for me Rich. Thanks