Archive

Search getting cancelled remotely or expired

renjujacob88
Path Finder

HI Splunkers,

When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.

alt text

Below is the sample query used:

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user

Is there any workaround on this issue.

0 Karma

Shan
Builder

@ renjujacob88

Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.

https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none...

Thanks,
Shankar

0 Karma

renjujacob88
Path Finder

@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors

0 Karma

renjujacob88
Path Finder

Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?

I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!