Splunk Enterprise Security

Bundle issues with SHC

d_lim
Path Finder

Hi all,

I'm having these error messages -

Streamed seach execute failed beacuse: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup' ...

After including the "| inputlookup local=t simple_identity_lookup" in my search, it seems to be running fine.

My question is, why is this happening, could it be that the bundles could not replicate to the indexers? If so, what port is the default for bundle replication from SHC to Indexers? So that I will need to allow the traffic from the ports

If not, what other possible causes may there be?

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!