Has anyone encountered this error: Asset and Identity Management issue?

[Paaattt]

Has anyone encountered this issue and how did you fixed it on Splunkcloud and Enterprise Security "Identity: An error occurred while the Asset and Identity Management modular input ran" ?  When I checked the error it is saying that Lookup file error, unknown path or update time. Pretty sure lookups is existing but I am not sure what it means by update time?

[ZachTheSplunkr]

This error exists since the KVstore is being used as opposed to a CSV file and does not interfere with the functionality of lookup creation.

See the known issue at: https://splunk-sa-crowdstrike.ztsplunker.com/releases/issues/

[hettervik]

Has anyone found the reason for this error message yet, and how to fix it?

We're encountering the same error. Both the lookup file and the lookup definition surely exists, and both are available when using inputlookup in the search bar. Also we've checked that they are available in the Splunk ES app. The identity list in Splunk ES does populate with data, so the "identity lookup merging searches" are in fact working, meaning that surely the "lookup file path exists" and is available for Splunk ES.

[hettervik]

We've looked a bit more into this case. The error is coming from the script "identity_manager.py" in the app "SA-IdentityManagement". The error is generated in the following "for" loop.

for url, path, size, last_updated in update_times:
  if path and last_updated:
    lookup[url] = last_updated
  else:
    logger.error('status="Lookup file error, unknown path or update time" name=%s', url)

The "update_times" array comes from the method "get_lookup_table_file_update_times", which again comes ultimately from the Python package "importlib.util.spec_from_file_location". We were thinking that this error might be from this package, and not from Splunk per se, but when we look at the actual lookup file CSV in the Linux OS, it is there and has the last modified time value sat, so that is not the cause either.

So, still haven't figured this out.

[anel]

Any updates? 

[rav_diesel]

In the same boat as you, have you figured this out? By the way, I switched over to SA-CrowdStrike with CrowdStrike Device TA and use it to build an asset tables. @Paaattt