Security

Has anyone encountered this error: Asset and Identity Management issue?

Paaattt
Engager

Has anyone encountered this issue and how did you fixed it on Splunkcloud and Enterprise Security "Identity: An error occurred while the Asset and Identity Management modular input ran" ?  When I checked the error it is saying that Lookup file error, unknown path or update time. Pretty sure lookups is existing but I am not sure what it means by update time?

Paaattt_1-1635463243381.png

 

Paaattt_0-1635463222543.png

 

Labels (1)

ZachTheSplunkr
Splunk Employee
Splunk Employee

This error exists since the KVstore is being used as opposed to a CSV file and does not interfere with the functionality of lookup creation.

 

See the known issue at: https://splunk-sa-crowdstrike.ztsplunker.com/releases/issues/

0 Karma

hettervik
Builder

Has anyone found the reason for this error message yet, and how to fix it?

We're encountering the same error. Both the lookup file and the lookup definition surely exists, and both are available when using inputlookup in the search bar. Also we've checked that they are available in the Splunk ES app. The identity list in Splunk ES does populate with data, so the "identity lookup merging searches" are in fact working, meaning that surely the "lookup file path exists" and is available for Splunk ES.

0 Karma

hettervik
Builder

We've looked a bit more into this case. The error is coming from the script "identity_manager.py" in the app "SA-IdentityManagement". The error is generated in the following "for" loop.

for url, path, size, last_updated in update_times:
if path and last_updated:
lookup[url] = last_updated
else:
logger.error('status="Lookup file error, unknown path or update time" name=%s', url)

The "update_times" array comes from the method "get_lookup_table_file_update_times", which again comes ultimately from the Python package "importlib.util.spec_from_file_location". We were thinking that this error might be from this package, and not from Splunk per se, but when we look at the actual lookup file CSV in the Linux OS, it is there and has the last modified time value sat, so that is not the cause either.

So, still haven't figured this out.

0 Karma

anel
Explorer

Any updates? 

0 Karma

rav_diesel
New Member

In the same boat as you, have you figured this out? By the way, I switched over to SA-CrowdStrike with CrowdStrike Device TA and use it to build an asset tables. @Paaattt 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...