Lookup table suddenly showing no data rows

[Tbundy]

One of my new colleagues was working on a lookup in a splunk app and seems to have somehow made a lookup table unavailable. His task involved creating and uploading a lookup csv, creating a lookup definition and creating an automatic lookup. No one else has been modifying this Splunk App.

An existing lookup started no longer populating in a dashboard. I looked at the “datasets” and the lookup csv exists and shows a last modified date from way before this issue started, but no rows display when I click on it.

I’m at a loss for what could have caused this or how to fix this. It seems the data still exists, as the modified date hasn’t changed, but somehow has become inaccessible.

[gcusello]

Hi @Tbundy,

Are you suing Lookup editor or are you speaking of |inputlookup command?

Then, admins can display the lookup?

Anyway, check the grants of your lookup, lookup definition and automatic lookup.

Ciao.

Giuseppe