topic Re: Getting errors when using outputlookup in Knowledge Management

Getting errors when using outputlookup

bigchungusfan55 — Tue, 22 Jul 2025 18:18:44 GMT

I am having issues trying to outputlookup to a new empty KV Store lookup table I made. When I try to run the following search, I get this error:

Error in 'outputlookup' command: Lookup failed because collection '<collection>' in app 'SplunkEnterpriseSecuritySuite' does not exist, or user '<username>' does not have read access.

I redacted the actual data I am using, but it is formatted the same way as above. My KV Store file has global sharing and everyone can read/write, for testing purposes.

What is wrong here and what can I do to fix this?

Re: Getting errors when using outputlookup

richgalloway — Tue, 22 Jul 2025 20:13:15 GMT

Did you put <collection> in a collections.conf file, distribute it to all SHs, and restart Splunk? Make sure the collections.conf file defines each field you want to use.

Re: Getting errors when using outputlookup

livehybrid — Tue, 22 Jul 2025 22:13:50 GMT

Hi @bigchungusfan55

Have you created the actual collections.conf collection stanza as well as creating the lookup definition?

It sounds like either the name in the definition of the lookup (which is where you match then name you use after outputlookup/inputlookup/lookup) is incorrect, or the collection itself does not exist.

Please can you review this and let us know?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Getting errors when using outputlookup

thahir — Wed, 23 Jul 2025 12:25:54 GMT

Hi @bigchungusfan55 ,

Please do the following check to find and fix the issue

1. check and confirm that the KV store collection exists

2. Check where the KV Store Lookup is defined

3. Check the permission for the lookup

4. check lookup defintion and collection configuration.

Re: Getting errors when using outputlookup

HiramMann — Fri, 05 Sep 2025 06:46:19 GMT

I’m thinking that this might be the same issue.

Re: Getting errors when using outputlookup

PickleRick — Fri, 05 Sep 2025 13:54:20 GMT

Adding to what's already been said - are you sure you're in the same app context as you created your collection in?

Re: Getting errors when using outputlookup

bigchungusfan55 — Fri, 05 Sep 2025 14:10:49 GMT

It seems that the collections.conf was not properly configured when I made the collection. I was under the assumption that the Splunk app for lookup file editing created a completed collections.conf when creating a lookup table using the tool (this was my first time trying it for this purpose). I have fixed the configuration file and successfully resolved the issue.