"Failed to re-open lookup file" error message and slow searches

Available Languages

Updated:September 29, 2026
Document ID:SPLK046448

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud

Description

When running a search, the search takes an abnormal amount of time and returns an error message in the UI

Investigation

Check to see if the search returns the following error message
  
Streamed search execute failed because: Error in 'lookup' command: 
Failed to re-open lookup file:
 '/opt/splunk/var/run/searchpeers/B2A6E1G1-123T-5L88-29E1-0P123EG54123-3918371/kvstore_s_SA-IdeAasd1DfaleoqAasE3asdf12b_identix4ASDeQENAGdyPwAEas4AS1D'.

Resolution

If you encounter this problem,
1. change the enable_splunkd_kv_lookup_indexing parameter to true in the [lookup] stanza of limits.confIn the $SPLUNK_HOME/etc/system/local directory on all of your search peers and
2. Restart for the change to take effect
https://docs.splunk.com/Documentation/Splunk/9.0.3/ReleaseNotes/KnownIssues#Search_issues

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles