Splunk Search

Search getting cancelled remotely or expired

renjujacob88
Path Finder

HI Splunkers,

When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.

alt text

Below is the sample query used:

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user

Is there any workaround on this issue.

0 Karma

Shan
Builder

@ renjujacob88

Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.

https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none...

Thanks,
Shankar

0 Karma

renjujacob88
Path Finder

@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors

0 Karma

renjujacob88
Path Finder

Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?

I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...