I've setup a search head with an application I've wrote that references a remote indexer. The application seems to work. However, I have the following error on the search head that does not appear on the indexer when I run the same app.
[splunk] The lookup table 'wksh_action_lookup' does not exist. It is referenced by configuration 'syslog'.
How do I resolve this error? Thanks.
the issue is most likely that the lookup table that your app is using isn't available to all the components involved in your app:
you should be able to resolve this by adding
[lookups]
export=system
to the default.meta
file (usually in $SPLUNK_HOME/etc/apps/<app_name>/metadata/
) for the app. be aware that this will make the lookup table available globally, which might not be what you want; you can scope this setting down as desired.
there is some documentation about app object permissions here:
the issue is most likely that the lookup table that your app is using isn't available to all the components involved in your app:
you should be able to resolve this by adding
[lookups]
export=system
to the default.meta
file (usually in $SPLUNK_HOME/etc/apps/<app_name>/metadata/
) for the app. be aware that this will make the lookup table available globally, which might not be what you want; you can scope this setting down as desired.
there is some documentation about app object permissions here: