Splunk Search

Inability to Write to Lookup FIle

LukeMurphey
Champion

The PCI app is producing errors indicating that the lookup files could not be written. Below is an example of the error:

[SimpleResultsTable module] Server
reported HTTP status=400 while getting
mode=results <?xml version='1.0'
encoding='UTF-8'?>

type='FATAL'>Error in
'outputlookup' command:
Could not write to file
'account_history_tracker.csv'.

How do I fix this issue?

1 Solution

LukeMurphey
Champion

Root Cause:

The issue is due to the fact that the lookup files are not writable. The PCI needs to be able to update the lookup files in order to function.

Solution:

To fix the issue, set the permissions on the lookup files to allow them to be writable by the account that Splunk is running under. The lookup files that need to be adjusted are available under the lookup directory of the following apps:

  • SplunkPCIComplianceSuite ($SPLUNK_HOME/etc/apps/SplunkPCIComplianceSuite/lookups)
  • PCI-Requirement11 ($SPLUNK_HOME/etc/apps/PCI-Requirement11/lookups)

View solution in original post

LukeMurphey
Champion

Root Cause:

The issue is due to the fact that the lookup files are not writable. The PCI needs to be able to update the lookup files in order to function.

Solution:

To fix the issue, set the permissions on the lookup files to allow them to be writable by the account that Splunk is running under. The lookup files that need to be adjusted are available under the lookup directory of the following apps:

  • SplunkPCIComplianceSuite ($SPLUNK_HOME/etc/apps/SplunkPCIComplianceSuite/lookups)
  • PCI-Requirement11 ($SPLUNK_HOME/etc/apps/PCI-Requirement11/lookups)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...