Splunk Search

Why is my dashboard giving error for only one lookup ?


Hello Everyone
I have a dashboard and when i ran it, it gave the following error:

[IDX01] Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

[IDX02]Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

It gave the error for all the indexers.

original search :

  | lookup device_lookup device_id as id OUTPUT device_ip
  | fields device_ip , orgDeviceName
  | stats count by device_ip 

but when i run

| inputlookup device_lookup

It works fine.

weirdly all other lookups run without local=true. However, only this particular lookup gives error when the search job is run

[IDX02]Failed to re-open lookup file: /opt/splunk/var/run/searchpeers/1B9FREERF-50TY-4767-AH6Y-B567EGRYEH-1539009321/kvstore_s_MSS-T@HX1YtUhJKI87IUImcch_netapp_dezbGUbszQGAW242l@NpogZ9AS

Please advise

0 Karma

Splunk Employee
Splunk Employee
0 Karma


Is it a KV-store lookup ? Are all other lookups similar type or csv lookups?

0 Karma


All are kvstore only

0 Karma


Hi @ramarcsight , I know its pretty old but just wanted to check if by any chance did you manage to resolve it? As I am facing similar issue now post upgrading environment to 8.1.X



0 Karma


Hi @bishtk  @ramarcsight 

Had the same "Failed to re-open lookup file" issue with few KVStore lookups.

Found some ".index.lock" artifacts for the lookups having the issue, using this search:

| rest splunk_server=local /servicesNS/-/-/configs/conf-lookups search="*"
| search title="*"
| eval title=if(like(title,"*"),null,title)
| dedup title
| rename eai:acl.app as app, eai:acl.perms.read as read, eai:acl.sharing as sharing
| fields - updated published id eai*
| rename title as stanza
| search stanza="*lock"
| table stanza

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...