I fixed this by putting the json-too_small : LOOKUP-ip_dst_lookups
and json-too_small : LOOKUP-ip_src_lookups
automatic lookups created by the nprobe
application to App only sharing. In my case, it was shared globally. Strangely enough, I didn't have this issue on all of my indexers either so I'm not sure the exact cause but it's probably related to permissions.
I've got the same issue on 6.4 & it appears to be tied to the probe app too. Did you manage to resolve this?
Hi,
Just to confirm there are no lookups built into the freenas app, so likely from another app.
Let me know if you do find it linked though!
Cheers
Check for an automatic lookup defined for sourcetype json-too_small
referring a lookup definition called ip_lookups
that doesn't exist or isn't shared with your roles.
You should remove the FreeNAS tag if you've found it to be not guilty.
actually, it looks like the problem started with nprobe and not freenas. But I'll poke around there and see what I can find.