Splunk Enterprise

Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file

LearningGuy
Motivator

Hello,

I received the following error, the issue resolved itself after 4 hours.  The CSV file size is 54 MB. 
Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file:
'opt/splunk/var/run/searchpeers/[random number]/apps/[app-name]/lookups/test.csv'

I am aware that there already a post in regards this, but I have more questions
1)  What is the cause of this error?    
Is it because of the bug like mentioned in the old post below?  I am running 9.0.4, the bug should have been fixed
https://community.splunk.com/t5/Splunk-Enterprise/Message-quot-Streamed-search-execute-failed-becaus...

2) a) Is it because max_memtable_bytes in limits.conf  is 25MB?
https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf

b) How do I check limit.conf via GUI without admin role?

c)  What does "Lookup files with size above max_memtable_bytes will be indexed on disk" mean?
     Is it a good thing or bad?

d) If I see cs.index.alive file auto generated, does it mean it's an indexed on disk?
[random number]/apps/[app-name]/lookups/test.csv
[random number]/apps/[app-name]/lookups/test.csv_[random number].cs.index.alive

3)  If I am not allowed to change any setting (increase 25MB limit),   
     what is the solution for this issue?

I appreciate your help. Thank you

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...