- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Error in 'lookup' command: Failed to re-open l...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Error in 'lookup' command: Why is it failing to re-open lookup file?
Hello Splunker!
Sometimes my searches on Splunk Enterprise Security Search Head ran into following error (mostly) without any results, sometimes there are only a view results :
[idx1, idx4 ...] Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file: '/opt/splunk/var/run/searchpeers/splunksearchhead-1631016538/kvstore_s_SA-IdeRjww0FotymhlCIaS1cqkc05a_identix3UXVbINERGdyPwDBuI5US7E'.
Sometimes the searches work, somtimes they not. There is also a "normal" Splunk Search Head, the same search works all the time. If the error appears also the Incident Review needs about
I already checked the bundle size of both Search Heads and the ES bundle is about 800mb. The "normal" Search Head bundle is about 1,1gb.
Splunk Enterprise 8.2.1
Splunk Enterprise Security 6.6.0
Splunk Cluster with 2 sites, each site 8 idx.
I would greatly appreciate any help 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, anybody managed to resolve this? Got a ticket open with Splunk for a month now...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@halu I'm getting the error and the searches are running and getting paused and resume after sometime we also upgraded to 8.2.3 recently, did you find any troubleshooting's to prevent this error.
Satish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have the same issue after upgrading to Splunk 8.2.3. Did you solve the issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry no I didn't resolv it yet. The error didn't appear 1-2 weeks, but its still happen user ran into this error
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please try increasing the max_memtable_bytes to higher than default i.e., 25 MB to 50MB.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the ES correlation set up page for Asset and Identity management ensure you have "enable selectively for source types" if used or disable if you don't.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
could you elaborate on your answer.
The message seems replication bundle related (replication=true for kv store collection).
What is the link with your answer ?
thanks in advance
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
