Error in 'expandiprange' command: (UnicodeDecodeError) 'utf-8' codec can't decode byte

Applicability

Description

In the Splunk Enterprise Security app, the "asset_lookup_by_str" functionality on the preview page was not functioning as expected, resulting in error messages.

Error Message:

Error in 'expandiprange' command: (UnicodeDecodeError) 'utf-8' codec can't decode byte 0xca in position 4883: invalid continuation byte

Investigation

During the investigation, the below error was observed in the internal logs.

06-27-2024 15:15:24.717 -0400 ERROR SearchMessages - orig_component="SearchStatusEnforcer" app="SplunkEnterpriseSecuritySuite" sid="1719515715.5799_1FF6183A-CF22-4D53-A9C1-29AA0F052EB9" message_key="" message=Error in 'expandiprange' command: (UnicodeDecodeError) 'utf-8' codec can't decode byte 0xca in position 4883: invalid continuation byte

06-27-2024 15:15:17.092 -0400 ERROR SearchProcessRunner [8601 PreforkedSearchesManager-0] - preforked process=0/4968 with search=0/9625 and cmd=splunkd\x00search\x00--id=1719515715.5799_1FF6183A-CF22-4D53-A9C1-29AA0F052EB9\x00--maxbuckets=300\x00--ttl=600\x00--maxout=500000\x00--maxtime=8640000\x00--lookups=1\x00--reduce_freq=10\x00--rf=*\x00--user=so3i3\x00--pro\x00--roles=admin:ess_admin:ess_analyst:ess_user:power:user\x00--sslclientsession=\x00\x00\x00 died on exception (exit_code=111): Error in 'expandiprange' command: (UnicodeDecodeError) 'utf-8' codec can't decode byte 0xca in position 4883: invalid continuation byte.

Upon further investigation, it was discovered an unrecognized special character in the lookup file causing the error.

Resolution

To resolve the issue, it was identified that the special character causing the issue in the lookup file and removed it. After making this change, it was verified that the asset_lookup_by_str functionality was restored and working as expected, with no further errors encountered. 

Related Links

Searchpreview