topic Re: Splunk API seach results - certain lookup returns empty, while others are functioning in Splunk Dev

Splunk API seach results - certain lookup returns empty, while others are functioning

eshcharc — Thu, 16 Nov 2023 09:40:37 GMT

Hello all,

I use Splunk API in order to export an SPL search.
All queries are working well on my local dev environment and most work on production server.

All queries that include or read from a certain query (let's call it "SessionEntities") seem to return empty.

For instance the query, " | inputlookup SessionEntities", returns empty.

The same query works both localy and even stranger, works on Splunk search page on the same server, while with the same query and different lookup, it returns with results.

That lookup is no different than the others (no bigger content size), but still.

Anyone has an idea of why could this be happening?

Re: Splunk API seach results - certain lookup returns empty, while others are functioning

ITWhisperer — Thu, 16 Nov 2023 09:54:26 GMT

Is the lookup visible to the user you are authenticating with for the API call?

Re: Splunk API seach results - certain lookup returns empty, while others are functioning

eshcharc — Thu, 16 Nov 2023 10:03:00 GMT

It seems to be no different than other working lookups on the same application. What else can I check other than the lookup's application permissions?

Re: Splunk API seach results - certain lookup returns empty, while others are functioning

eshcharc — Thu, 16 Nov 2023 10:28:45 GMT

@ITWhisperer Double checked, and it was indeed an issue of permissions of the lookup transform

A big thank from me for helping!