error on search head

[DTERM]

I've setup a search head with an application I've wrote that references a remote indexer. The application seems to work. However, I have the following error on the search head that does not appear on the indexer when I run the same app.

[splunk] The lookup table 'wksh_action_lookup' does not exist. It is referenced by configuration 'syslog'.

How do I resolve this error? Thanks.

[piebob · Accepted solution]

the issue is most likely that the lookup table that your app is using isn't available to all the components involved in your app:

you should be able to resolve this by adding

[lookups]
export=system

to the default.meta file (usually in $SPLUNK_HOME/etc/apps/<app_name>/metadata/ ) for the app. be aware that this will make the lookup table available globally, which might not be what you want; you can scope this setting down as desired.

there is some documentation about app object permissions here:

http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step5SetPermissions#make_objects_global...