Deployment Architecture

error on search head


I've setup a search head with an application I've wrote that references a remote indexer. The application seems to work. However, I have the following error on the search head that does not appear on the indexer when I run the same app.

[splunk] The lookup table 'wkshactionlookup' does not exist. It is referenced by configuration 'syslog'.

How do I resolve this error? Thanks.

Tags (2)
0 Karma

Re: error on search head

Splunk Employee
Splunk Employee

the issue is most likely that the lookup table that your app is using isn't available to all the components involved in your app:

you should be able to resolve this by adding


to the default.meta file (usually in $SPLUNK_HOME/etc/apps/<app_name>/metadata/ ) for the app. be aware that this will make the lookup table available globally, which might not be what you want; you can scope this setting down as desired.

there is some documentation about app object permissions here:

View solution in original post