Splunk Enterprise Security

Bundle issues with SHC

d_lim
Path Finder

Hi all,

I'm having these error messages -

Streamed seach execute failed beacuse: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup' ...

After including the "| inputlookup local=t simple_identity_lookup" in my search, it seems to be running fine.

My question is, why is this happening, could it be that the bundles could not replicate to the indexers? If so, what port is the default for bundle replication from SHC to Indexers? So that I will need to allow the traffic from the ports

If not, what other possible causes may there be?

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...