topic How to resolve API Search Lookup ERROR? in Splunk Cloud Platform

How to resolve API Search Lookup ERROR?

laauespinosa — Tue, 26 Jul 2022 14:25:45 GMT

Hi,

We are doing consults via API with the query:

index=_internal sourcetype=splunk_python subject |fields subject,recipients | where subject like "%ORION%"'

But when we try to collect the results, give us an error from a lookup that is not part of the original search.

Via web the search is working fine, but the problem is via API.

Have you experienced something like that?

Thanks!

Re: How to resolve API Search Lookup ERROR?

schose — Tue, 26 Jul 2022 20:20:22 GMT

Hi,

when searching via API you are providing parameters:

cparams = { "host" : lconfig["host"], "port" : lconfig["port"], "username" : lconfig["user"], "password" : lconfig["password"], "app" : lconfig["app"] }

most propably you are not using same user or correct app context.

check index=_audit and/or index=_internal sourcetype=splunkd_access + username..

best regards,

Andreas