Talking about this app in case it's ambiguous: https://splunkbase.splunk.com/app/1724
I have used it to create a KV store, as apparently that's the only way to do so in splunk cloud. I have also created a corresponding lookup definition.
However, the resulting object is unusable. I keep getting:
"Error in 'inputlookup' command: Lookup failed because collection 'xyz' in app 'lookup_editor' does not exist, or user 'abc' does not have read access."
Both the lookup definition and the collection are global and readable by anyone. What am I missing?
When I edit the KVstore in the lookup editor, I can see a dropdown "showing entries for: abc". I'm really confused by this. How can the content of a lookup (KV store or not) depend on the user?
I deleted everything and tried again, this time I specified the collection should be created in the Enterprise Security app and it worked.
Still very confused about the "showing entries for: abc".
I deleted everything and tried again, this time I specified the collection should be created in the Enterprise Security app and it worked.
Still very confused about the "showing entries for: abc".