Splunk® Enterprise Security

Administer Splunk Enterprise Security

Download manual as PDF

Download topic as PDF

Troubleshoot lookups in Splunk Enterprise Security

Troubleshoot Splunk issues regarding lookups and available memory.

Lookups not respecting ASCII name order

Splunk Enterprise does not honor lexicographical order of automatic search-time lookups when some of the lookups in a set are configured to execute in-memory versus when some of the lookups in the set are configured to be indexed.

For instance, if you have max_memtable_bytes set to 50MB, assets_by_cidr lookup set to 25MB, and assets_by_str lookup set to 75MB. This would cause assets_by_str to be indexed and assets_by_cidr to run in memory, resulting in assets_by_cidr inadvertently executing prior to assets_by_str.

Increase the max_memtable_bytes of the lookup stanza in the $SPLUNK_HOME/etc/system/default/limits.conf file. See limits.conf in the Splunk Enterprise Admin Manual.

Lookup tables exceeding the maximum length

Lookup table files that exceed the HTTP httpServer:max_content_length in server.conf will not be replicated across search head cluster members.

Increase the max_content_length of the http_input stanza in the $SPLUNK_HOME/etc/system/default/server.conf file. See server.conf in the Splunk Enterprise Admin Manual.

Lookup files growing in excess of 1GB

Lookup table files involved in special search matches, such as CIDR or Wildcard, are required to run in memory. This can lead to running out of memory when using these features.

Increase the max_memtable_bytes<code> of the <code>lookup stanza in the $SPLUNK_HOME/etc/system/default/limits.conf file. See limits.conf in the Splunk Enterprise Admin Manual.

PREVIOUS
Troubleshoot dashboards in Splunk Enterprise Security
  NEXT
Dashboard requirements matrix for Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 5.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters