Why does a search with inputlookup work when used in Splunk Web, but returns no results when using the REST API?

[mohankesireddy]

"inputlookup" command works fine when I use in Splunk UI, but same search comes back with no results when I search through REST API:

curl -w "@curl-format.txt" -s -k -u admin:changes  https://localhost:8089/servicesNS/admin/search/search/jobs -d search="| inputlookup lookupdefinition” -d output_mode=json

[mohankesireddy · Accepted solution]

found the issue, its not the issue with REST API but permissions. the lookup permissions are constrained to an app context and the REST search using a different app context.

# curl -ku user:support https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="| inputlookup ip2internalhostname" -d output_mode=json
{"preview":false,"offset":0,"lastrow":true,"result":{"hostname":"big","src":"0.0.0.0"}}