Why is KV store created by lookup editor app, unusable?

[gabriel_vasseur]

Talking about this app in case it's ambiguous: https://splunkbase.splunk.com/app/1724

I have used it to create a KV store, as apparently that's the only way to do so in splunk cloud. I have also created a corresponding lookup definition.

However, the resulting object is unusable. I keep getting:

"Error in 'inputlookup' command: Lookup failed because collection 'xyz' in app 'lookup_editor' does not exist, or user 'abc' does not have read access."

Both the lookup definition and the collection are global and readable by anyone. What am I missing?

When I edit the KVstore in the lookup editor, I can see a dropdown "showing entries for: abc". I'm really confused by this. How can the content of a lookup (KV store or not) depend on the user?

[gabriel_vasseur · Accepted solution]

I deleted everything and tried again, this time I specified the collection should be created in the Enterprise Security app and it worked.

Still very confused about the "showing entries for: abc".