Does anybody have any idea on what is causing the following error?
Error in 'lookup' command: Error using lookup table 'tm_asn': CIDR and wildcard matching is restricted to lookup files under the in-memory size limit.
Reading the error message, I think what it's saying is that your lookup you are trying to use is too big to use CIDR matching on. I'm not 100% positive, but I believe you might resolve this by bumping up some settings in your limits.conf file. Specifically, look down in the [section limits and notice this section...
max_memtable_bytes = <integer>
* Maximum size, in bytes, of static lookup file to use an in-memory index for.
* Lookup files with size above max_memtable_bytes will be indexed on disk
* A large value results in loading large lookup files in memory leading to bigger
process memory footprint.
* Caution must be exercised when setting this parameter to arbitrarily high values!
* Default: 10000000 (10MB)
That second bullet point describes what I think is your issue. The amount of memory a lookup table is allowed to have is X, but this lookup table is sized X+Y, so it's too big and stays on disk. Because it's on disk, certain types of matching (CIDR and wildcard matching) aren't allowed.
So give that setting a shot, see what it gets you! Maybe try doubling it - or add 10 MB at a time until the problem goes away.
Happy Splunking,
Rich
Reading the error message, I think what it's saying is that your lookup you are trying to use is too big to use CIDR matching on. I'm not 100% positive, but I believe you might resolve this by bumping up some settings in your limits.conf file. Specifically, look down in the [section limits and notice this section...
max_memtable_bytes = <integer>
* Maximum size, in bytes, of static lookup file to use an in-memory index for.
* Lookup files with size above max_memtable_bytes will be indexed on disk
* A large value results in loading large lookup files in memory leading to bigger
process memory footprint.
* Caution must be exercised when setting this parameter to arbitrarily high values!
* Default: 10000000 (10MB)
That second bullet point describes what I think is your issue. The amount of memory a lookup table is allowed to have is X, but this lookup table is sized X+Y, so it's too big and stays on disk. Because it's on disk, certain types of matching (CIDR and wildcard matching) aren't allowed.
So give that setting a shot, see what it gets you! Maybe try doubling it - or add 10 MB at a time until the problem goes away.
Happy Splunking,
Rich
aracer,
If the above setting worked, could you mark this answer as Accepted?
If not, please write back with more information and we'll continue to help!
Happy Splunking,
Rich
That worked for me Rich. Thanks