Hello,
I received the following error, the issue resolved itself after 4 hours. The CSV file size is 54 MB.
Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file:
'opt/splunk/var/run/searchpeers/[random number]/apps/[app-name]/lookups/test.csv'
I am aware that there already a post in regards this, but I have more questions
1) What is the cause of this error?
Is it because of the bug like mentioned in the old post below? I am running 9.0.4, the bug should have been fixed
https://community.splunk.com/t5/Splunk-Enterprise/Message-quot-Streamed-search-execute-failed-becaus...
2) a) Is it because max_memtable_bytes in limits.conf is 25MB?
https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf
b) How do I check limit.conf via GUI without admin role?
c) What does "Lookup files with size above max_memtable_bytes will be indexed on disk" mean?
Is it a good thing or bad?
d) If I see cs.index.alive file auto generated, does it mean it's an indexed on disk?
[random number]/apps/[app-name]/lookups/test.csv
[random number]/apps/[app-name]/lookups/test.csv_[random number].cs.index.alive
3) If I am not allowed to change any setting (increase 25MB limit),
what is the solution for this issue?
I appreciate your help. Thank you
