topic Re: Scheduled search with only | inputlookup in the search returns zero results in Splunk Enterprise https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704947#M20872 <P>It's under my username, with Admin privileges.</P> Thu, 21 Nov 2024 12:27:58 GMT SteveBowser 2024-11-21T12:27:58Z Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704938#M20870 <P>I created a scheduled search that reads 2 input lookup csv files. It returns zero results when I look at the "View Recent"/Job Manager. When I run it by clicking the "Run" selection, I get the results that I'm looking for. What am I overlooking?&nbsp;</P> Thu, 21 Nov 2024 11:39:07 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704938#M20870 SteveBowser 2024-11-21T11:39:07Z Re: Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704946#M20871 <P>Which user does the scheduled search run as and do they have access to the lookup files?</P> Thu, 21 Nov 2024 12:25:40 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704946#M20871 ITWhisperer 2024-11-21T12:25:40Z Re: Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704947#M20872 <P>It's under my username, with Admin privileges.</P> Thu, 21 Nov 2024 12:27:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704947#M20872 SteveBowser 2024-11-21T12:27:58Z Re: Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704948#M20873 <P>Sorry, I have access to the files.</P> Thu, 21 Nov 2024 12:28:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/704948#M20873 SteveBowser 2024-11-21T12:28:53Z Re: Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/705432#M20939 <P>There are no timestamps in the lookup table. When I plug one in, I get the desired results.&nbsp;</P><P>&nbsp;</P> Wed, 27 Nov 2024 18:27:26 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/705432#M20939 SteveBowser 2024-11-27T18:27:26Z Re: Scheduled search with only | inputlookup in the search returns zero results https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/706385#M21041 <P>Answering my own question here - it needs to have dates to display results. In the end, I wrote the results to a summary index in a scheduled search using | collect index=test_summary addtime=true.&nbsp;</P> Mon, 09 Dec 2024 18:17:23 GMT https://community.splunk.com/t5/Splunk-Enterprise/Scheduled-search-with-only-inputlookup-in-the-search-returns/m-p/706385#M21041 SteveBowser 2024-12-09T18:17:23Z