Splunk Enterprise Security

Why do I see error "lookup_conversion: A lookup table could not be created..." in Splunk 6 with clustering enabled and ES on one search head?

mcronkrite
Splunk Employee
Splunk Employee
lookup_conversion: A lookup table could not be created (key: tld, tempfile: /opt/splunk/var/run/splunk/lookup_tmp/lookup_conXXXXX.txt)

I see this error intermittently in a Splunk 6 environment with Clustering enabled, and Enterprise security on one search head. Wondering if this is a result of manual system restarts (during configuration) or something more is going on.

0 Karma

krishnacasso
Path Finder

ha! this is a known issue:

http://docs.splunk.com/Documentation/ES/latest/RN/KnownIssues

On a Windows search head, the asset and identity center shows no results. Error messages will be displayed on the search head about missing lookup files. The python_modular_inputs.log reports errors:
ERROR pid=4040 tid=asset file=writers.py:_move_lookup:108 | FAILURE: Temporary output file was not created: C:Program FilesSplunkvarrunsplunklookup_tmplookup_conv6jppog.txt
ERROR pid=4040 tid=asset file=writers.py:move_lookups:156 | FAILURE: A lookup table could not be created: (key: cidr, tempfile: C:Program FilesSplunkvarrunsplunklookup_tmplookup_conv6jppog.txt)
The asset and identity lookup creation and expansion process is not working correctly due to an issue with a python script on Windows. Please contact Splunk Support for a replacement script and reference SOLNESS-4642. (SOLNESS-4642)
Once the script is obtained, follow the instructions below:
1. Replace the writers.py script in $SPLUNK_HOMEetcappsSA-UtilslibSolnCommonlookup_conversion
2. Make sure all the .csv's in SA-IdentityManagementlookups are there, and if not create a new copy from the .csv.default files.
3. Delete all the contents under $SPLUNK_HOMEvarlibsplunkmodinputsidentity_manager
4. Restart Splunk Enterprise

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...