Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup

[Varsha1]

Hi All,

I'm facing issue while appending results for 2 searches using append command. 

I have a 2 search which i'm using to get results and also both query has lookup command to get ip_address details from a lookup .

Search query1: index=abc filter1=A | eval ..| table * | lookup def host as host OUTPUT ipaddress | stats ..| eval ..

Query 2: index=abc filter2=B | eval ..| table * | lookup def host as host OUTPUT ipaddress | stats ..| eval ..

Both searches are almost same except "filter" field and eval commands. And i'm using append command to append results as below:

index=abc filter1=A | eval ..| table * | lookup def host as host OUTPUT ipaddress | stats ..| eval ..| append [search index=abc filter2=B | eval ..| table * | lookup def host as host OUTPUT ipaddress | stats ..| eval ..]

I'm getting error ([subsearch]: Streamed search execute failed because: Error in 'lookup' command: Could not construct lookup) when running above query and runs fine if i run it seperately.

Please let me know what i am making wrong.

[starcher]

Most often that message happens when the csv behind the lookup definition is missing. Check that.

[richgalloway · Accepted solution]

Consider moving the lookup command to after the append.

index=abc filter1=A 
| eval ..
| table * 
| stats ..
| eval ..
| append [search index=abc filter2=B 
  | eval ..| table * 
  | stats ..
  | eval ..
]
| lookup def host as host OUTPUT ipaddress 

[richgalloway]

I wish I had an explanation.  You'd have to look at the search log for the failing search to see how that error is triggered.

Moving the lookup call was mainly a shot in the dark, but also should be more efficient by doing the lookups after the number of events have been reduced by stats.

[Varsha1]

@richgalloway , It is working fine when i used it at the end.  can you explain the logic behind it please. 

Thank you so much for the answer !!

[ITWhisperer]

Subsearches are limited to 50,000 events. Could this be your issue? Could you try with smaller timeframes?

[Varsha1]

I'm running it for last 60min and it is below 50000 events only