Splunk Enterprise Security

ES 3 lookup expander

Path Finder

A customer is having trouble with their ES installation -- for some reason the lookup expander is not working properly. It seems that it may not be reading the input file? See the line below from python_modular_input.log:

2014-05-09 11:18:47,620 INFO pid=47089 tid=asset file=conversion.py:process:276 | PROCESSING: All 0 input lines completed.

The process appears to proceed fairly normally (as compared with a working installation) with the exception being that the working installation processes numerous input lines and and then enumerates the contents of those lines in the logs, resulting in working expanded CSVs. The non-working installation does not log any errors -- just says that there were 0 input lines and finishes without expanding the lookups. The lookup works normally in core splunk (i.e. inputlookup append=T asset_lookup).

0 Karma

Path Finder


The same thing happens here. Identities are working fine though, but assets are not expanding. Ive tried numerous times with different filenames, settings but no luck. No errors in logs, inputlookup works fine but assets are not expanded.

Runnin ess 3.1.1 on Splunk 6.1.3 on windows 2012 r2.

Anyone able to help or point to the right direction?


0 Karma

Path Finder

Anyone experiencing the same?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...