Splunk Search

Search getting cancelled remotely or expired

renjujacob88
Path Finder

HI Splunkers,

When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.

alt text

Below is the sample query used:

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user

Is there any workaround on this issue.

0 Karma

Shan
Builder

@ renjujacob88

Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.

https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none...

Thanks,
Shankar

0 Karma

renjujacob88
Path Finder

@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors

0 Karma

renjujacob88
Path Finder

Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?

I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user

0 Karma
Get Updates on the Splunk Community!

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...