Search getting cancelled remotely or expired

[renjujacob88]

HI Splunkers,

When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.

Below is the sample query used:

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user

Is there any workaround on this issue.

[Shan]

@ renjujacob88

Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.

https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none...

Thanks,
Shankar

[renjujacob88]

@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors

[renjujacob88]

Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?

I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user