https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427974#M122487 <P>Check if the lookup or lookup definition exists in other search head (whatever is used in that alert). If lookup exists, check the sharing permissions of the lookup is same or not on both search heads.</P> Mon, 11 Mar 2019 19:33:46 GMT somesoni2 2019-03-11T19:33:46Z https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427973#M122486 <P>How can I determine:</P> <P>1) Why a Lookup is working on one search head but not on another?</P> <P>2) How to get it to work on the second search head.</P> <P>More detail:<BR /> I've been tasked with consolidating alerts on one search head. One of the alerts boils down to whether a macro containing the Lookup "thostinfo" works. I notice that on the SH it works, it is mentioned in "Searches, Reports, and Alerts"; on the SH where it doesn't it is not listed there. </P> <P>I've found <A href="https://answers.splunk.com/answers/472888/splunk-app-for-windows-infrastructure-how-to-fix-t.html">https://answers.splunk.com/answers/472888/splunk-app-for-windows-infrastructure-how-to-fix-t.html</A> and wondered if the accepted answer would work. But I barely know enough to ask what questions I should be asking.</P> <P>Many thanks.</P> Mon, 11 Mar 2019 18:42:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427973#M122486 DavisLee 2019-03-11T18:42:54Z https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427974#M122487 <P>Check if the lookup or lookup definition exists in other search head (whatever is used in that alert). If lookup exists, check the sharing permissions of the lookup is same or not on both search heads.</P> Mon, 11 Mar 2019 19:33:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427974#M122487 somesoni2 2019-03-11T19:33:46Z https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427975#M122488 <P>The Lookup Definitions exist on both search heads and the permissions are the same.</P> <P>Thank you</P> Mon, 11 Mar 2019 19:44:50 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427975#M122488 DavisLee 2019-03-11T19:44:50Z https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427976#M122489 <P>Are they both in the same app or in different app in both search heads? Also, what's the permission of the app and lookup? is that global OR app specific? In both the search heads, are you able to run something like <CODE>|inputlookup yourlookupname.csv</CODE></P> <P>from the Search app?</P> Tue, 12 Mar 2019 10:10:53 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427976#M122489 lakshman239 2019-03-12T10:10:53Z https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427977#M122490 <P>Is it possible that on the server where:</P> <BLOCKQUOTE> <P>it is mentioned in "Searches, Reports, and Alerts"<BR /> That the search in question is actually a "populating search" which writes data to the csv?</P> </BLOCKQUOTE> <P>Have you tried to see if Splunk can display the contents of the file using |inputlookup mylookup.cvs<BR /> If so - are the results the same on both search heads?</P> Tue, 12 Mar 2019 10:43:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-a-lookup-working-on-one-search-head-and-not-another/m-p/427977#M122490 nickhills 2019-03-12T10:43:46Z