9.4.5: SearchHead Cluster csv notification!!!

[verbal_666]

Hello.

Installed today a little environment with 3 SHs in Clustered ENV with a full clean 9.4.5 installation.

The first message, after configuring and starting the cluster is

I have no csv in $SPLUNK_HOME/ exceeding the limit size (which is 5GB, in memory).

What is it?

Thanks.

[PrewinThomas]

@verbal_666 

If you’ve removed the file, redeploy the app bundle to the search head cluster and verify again.

index=_internal sourcetype=splunkd "quarantined lookup"

or run the same rest call

Alternatively, try adding at least a valid header row to the CSV, then push the bundle again and recheck.

If the message still appears, it may be a UI glitch or require some time to clear automatically.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[verbal_666]

Query in splunkd gives no entries.

I tried,

1. edit the TEST.csv with lookup_editor, save... alarm still there!
2. delete TEST.csv... alarm still there!
3. remove the app from Deployer... alarm still there!
4. redeploy the app from Deployer... alarm still there!

It's quite misterious.

Rolled back to 9.3.6... no alarm! 😷

[PrewinThomas]

Thats interesting.
Looks like bug or UI glitch. Any possibility for you to test this on version 10.x?

[verbal_666]

I'll try 👍

[verbal_666]

Bah...... that's strange... i tried first to delete completely the Deployer "var", totally reinstall the 9.4.5 SH-Cluster, and the problem has gone 🙄 

It seems it was a first cluster notification that was stuck somewhere. I also deleted all the "var" from all SHC and relaunched the SHC bootstrap. Nothing happened.

Really do not know 😦

SPLUNK has some very strange behavious sometimes 🤔

[burwell]

Looks like you can find the quarantined lookup files https://splunk.my.site.com/customer/s/article/Monitor-quarantined-lookup-files

[verbal_666]

I searched yet the quarantined lookup...

| rest /services/replication/configuration/quarantined-assets splunk_server=local

Also the new query you linked gives the same csv...

nobody	my_web_app	TEST.csv	ae488df36e68414c86ef7d9c6f953fde8945cf92	[ {quarantined_at_host=https://centos:8089, quarantined_at=1761477321, lookup_size=0, quarantine_reason=lookup_size_unknown} ]	10/26/2025 12:15:21	0.00

1. "TEST.csv" is no longer present on the SH-Cluster, i deleted it 😶 alarm persists!!!
2. "TEST.csv" was anywhere 0 kb size, empty 🤔
3. IMO "quarantine_reason=lookup_size_unknown" is some case of bug!!!