All Apps and Add-ons

Receiving Error when trying to use Third Man.

aracer
Engager

Does anybody have any idea on what is causing the following error?

Error in 'lookup' command: Error using lookup table 'tm_asn': CIDR and wildcard matching is restricted to lookup files under the in-memory size limit.

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Reading the error message, I think what it's saying is that your lookup you are trying to use is too big to use CIDR matching on. I'm not 100% positive, but I believe you might resolve this by bumping up some settings in your limits.conf file. Specifically, look down in the [section limits and notice this section...

max_memtable_bytes = <integer>
* Maximum size, in bytes, of static lookup file to use an in-memory index for.
* Lookup files with size above max_memtable_bytes will be indexed on disk
* A large value results in loading large lookup files in memory leading to bigger 
  process memory footprint.
* Caution must be exercised when setting this parameter to arbitrarily high values!
* Default: 10000000 (10MB)

That second bullet point describes what I think is your issue. The amount of memory a lookup table is allowed to have is X, but this lookup table is sized X+Y, so it's too big and stays on disk. Because it's on disk, certain types of matching (CIDR and wildcard matching) aren't allowed.

So give that setting a shot, see what it gets you! Maybe try doubling it - or add 10 MB at a time until the problem goes away.

Happy Splunking,
Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

Reading the error message, I think what it's saying is that your lookup you are trying to use is too big to use CIDR matching on. I'm not 100% positive, but I believe you might resolve this by bumping up some settings in your limits.conf file. Specifically, look down in the [section limits and notice this section...

max_memtable_bytes = <integer>
* Maximum size, in bytes, of static lookup file to use an in-memory index for.
* Lookup files with size above max_memtable_bytes will be indexed on disk
* A large value results in loading large lookup files in memory leading to bigger 
  process memory footprint.
* Caution must be exercised when setting this parameter to arbitrarily high values!
* Default: 10000000 (10MB)

That second bullet point describes what I think is your issue. The amount of memory a lookup table is allowed to have is X, but this lookup table is sized X+Y, so it's too big and stays on disk. Because it's on disk, certain types of matching (CIDR and wildcard matching) aren't allowed.

So give that setting a shot, see what it gets you! Maybe try doubling it - or add 10 MB at a time until the problem goes away.

Happy Splunking,
Rich

Richfez
SplunkTrust
SplunkTrust

aracer,

If the above setting worked, could you mark this answer as Accepted?

If not, please write back with more information and we'll continue to help!

Happy Splunking,
Rich

0 Karma

scc00
Contributor

That worked for me Rich. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...