Splunk Enterprise

Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file

LearningGuy
Builder

Hello,

I received the following error, the issue resolved itself after 4 hours.  The CSV file size is 54 MB. 
Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file:
'opt/splunk/var/run/searchpeers/[random number]/apps/[app-name]/lookups/test.csv'

I am aware that there already a post in regards this, but I have more questions
1)  What is the cause of this error?    
Is it because of the bug like mentioned in the old post below?  I am running 9.0.4, the bug should have been fixed
https://community.splunk.com/t5/Splunk-Enterprise/Message-quot-Streamed-search-execute-failed-becaus...

2) a) Is it because max_memtable_bytes in limits.conf  is 25MB?
https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf

b) How do I check limit.conf via GUI without admin role?

c)  What does "Lookup files with size above max_memtable_bytes will be indexed on disk" mean?
     Is it a good thing or bad?

d) If I see cs.index.alive file auto generated, does it mean it's an indexed on disk?
[random number]/apps/[app-name]/lookups/test.csv
[random number]/apps/[app-name]/lookups/test.csv_[random number].cs.index.alive

3)  If I am not allowed to change any setting (increase 25MB limit),   
     what is the solution for this issue?

I appreciate your help. Thank you

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...