Splunk Enterprise Security

Bundle issues with SHC

d_lim
Path Finder

Hi all,

I'm having these error messages -

Streamed seach execute failed beacuse: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup' ...

After including the "| inputlookup local=t simple_identity_lookup" in my search, it seems to be running fine.

My question is, why is this happening, could it be that the bundles could not replicate to the indexers? If so, what port is the default for bundle replication from SHC to Indexers? So that I will need to allow the traffic from the ports

If not, what other possible causes may there be?

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...