HI Splunkers,
When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.
Below is the sample query used:
index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user
Is there any workaround on this issue.
@ renjujacob88
Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.
https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none...
Thanks,
Shankar
@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors
Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?
I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes
index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user