All Apps and Add-ons

Splunk external lookup script within app not running


Based on the documentation:

The script must be located in one of two places:
See "More about the external lookup script" for more information about how such scripts work.

When I have the script within the apps/<app_name>/bin directory it is never picked up. When I move it to the searchscripts directory it runs just fine. Is the ability to have external lookup scripts within an app not possible? (Splunk 6.3)

Here is my transforms.conf:

[testLookup] testField1 testField2
fields_list=testField1, testField2


I had the same issue on Splunk 6.4.4 and had to make sure, that the metadata/default.meta included not only the permission for the lookup. I simply added:

access = read : [ * ], write : [ * ]
export = system
0 Karma


I have the same problem.

Here's the very basic lookup script I've created (

import logging


If I put it in $SPLUNK_HOME/etc/apps/<app_name>/bin, I get the error

Could not find ''. It is required for lookup 'external_lookup'.

But if I put it in $SPLUNK_HOME/etc/apps/<app_name>/bin it works fine.

0 Karma


I don't know for sure if this matters, but is your transforms in the same app you are putting the script in?

0 Karma


Yes my transforms.conf is in the app.

0 Karma

Path Finder

are you on NT or *nix, and what are the permissions on the script?

0 Karma


*nix and I have given execute permissions to the user (splunk) and all just to make sure it can get access to it.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...