I've setup a search head with an application I've wrote that references a remote indexer. The application seems to work. However, I have the following error on the search head that does not appear on the indexer when I run the same app.
[splunk] The lookup table 'wkshactionlookup' does not exist. It is referenced by configuration 'syslog'.
the issue is most likely that the lookup table that your app is using isn't available to all the components involved in your app:
you should be able to resolve this by adding
to the default.meta file (usually in $SPLUNK_HOME/etc/apps/<app_name>/metadata/ ) for the app. be aware that this will make the lookup table available globally, which might not be what you want; you can scope this setting down as desired.
there is some documentation about app object permissions here: