Bundle issues with SHC

[d_lim]

Hi all,

I'm having these error messages -

Streamed seach execute failed beacuse: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup' ...

After including the "| inputlookup local=t simple_identity_lookup" in my search, it seems to be running fine.

My question is, why is this happening, could it be that the bundles could not replicate to the indexers? If so, what port is the default for bundle replication from SHC to Indexers? So that I will need to allow the traffic from the ports

If not, what other possible causes may there be?

[thambisetty · Accepted solution]

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize