QUESTION

When attempting to create a Scheduled Search enrichment, I consistently encounter the following error:

{"errorMessage":"failed to update lookup, please try again later","errorType":"multiKindError"}

After further investigation, I identified the following cause:

error": "update 'lookuptablequery-xxx-xxx-xxx-xxx-xxx' failed: This Scheduled Query does not contain a LIMIT clause in the SQL expression. Update the SQL expression to add a LIMIT clause to save this Scheduled Query."

ANSWER

You can resolve this issue by navigating to General > Data Lake and disabling the LIMIT Clause for Scheduled Searches option. For a detailed explanation, please refer to the Panther Documentation.