Splunk Enterprise Security

Bundle issues with SHC

d_lim
Path Finder

Hi all,

I'm having these error messages -

Streamed seach execute failed beacuse: Error in 'lookup' command: Could not construct lookup 'simple_identity_lookup' ...

After including the "| inputlookup local=t simple_identity_lookup" in my search, it seems to be running fine.

My question is, why is this happening, could it be that the bundles could not replicate to the indexers? If so, what port is the default for bundle replication from SHC to Indexers? So that I will need to allow the traffic from the ports

If not, what other possible causes may there be?

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

may be the lookup file you are referencing blacklisted from replicating to indexers. 

if you are running latest version of Splunk Enterprise 8.0 and above, I believe you have enterprise security also, open ES - > Configure - > Data Enrichment -> Asset and Identity Management -> Identity Lookup Configuration open the one which is used your lookup simple_identity_lookup then you will blacklist box checked. you can uncheck if you want simple_identity_lookup to be part of search head knowledge bundle.

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Limittheknowledgebundlesize

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...