Splunk Enterprise Security

Splunk App for Enterprise Security: Where to change the setting for lookup table maximum allowable value?

grambo271
Explorer

Greetings... I'm still very junior to the world of Splunk so I thought I'd reach out to the community for a little direction. We are running the Enterprise Security Suite 3x version on Splunk 6.1.3. I have noticed the following messsage is generated daily:

"msg="A lookup table used in a CIDR or WILDCARD definition exceeds the maximum allowable value" file="asn_by_cidr.csv" size="14690788" limit="10000000"

I have tried (with little success) to find out where this size limit is defined. Has anyone else seen this error and if so, could you suggest where to change this setting?

Thanks in advance

1 Solution

Nicolo_Figiani
Path Finder

Hi,
I had the same problem (on ES 3.1 and Splunk 6.1.3). I solved the issue by editing the following configuration file:

/opt/splunk/etc/system/local/limits.conf

In particular, I've added the following snippet of configuration:

[lookup]
max_memtable_bytes = 100000000

The increase of "max_memtable_bytes" will make the error message to stop appearing and will make Splunk working without trouble.

Regards.

View solution in original post

Nicolo_Figiani
Path Finder

Hi,
I had the same problem (on ES 3.1 and Splunk 6.1.3). I solved the issue by editing the following configuration file:

/opt/splunk/etc/system/local/limits.conf

In particular, I've added the following snippet of configuration:

[lookup]
max_memtable_bytes = 100000000

The increase of "max_memtable_bytes" will make the error message to stop appearing and will make Splunk working without trouble.

Regards.

grambo271
Explorer

Thank you both. The addition of the [lookup] stanza seems to have fixed the issue.

Appreciate your assistance!!

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee

Notes this must be system local you can't include this setting in an app

DerekKing
Path Finder

I think you'll find all global default limits, in the /etc/system/defaults/limits.conf file.

Take a copy of it into the local directory, and then make your changes.

Regards
Derek

Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...