Help needed with lookup error

[Roy_9]

Anyone have an idea on the below issue?

| inputlookup test
the lookup table file and definition both are available, both of the permissions are set to read(everyone)- set to app level, but when i am trying to inputlookup i am seeing the error.

Initially the lookup definition is set to read everyone and lookup file is set to read admin, so i changed it to everyone this afternoon and tried the below search but i am still getting below error

| inputlookup test


The lookup table 'test' requires a .csv or KV store lookup definition.
The lookup table 'test' is invalid.

Btw this is on Production Search head in a clustered environment

[Roy_9]

@VatsalJagani @PickleRick Can you please help me with this?

[VatsalJagani]

@Roy_9 - Are you running the search in the same App where you created the lookup definition?

[Roy_9]

Hi @VatsalJagani 
I am getting the results, when i am running it inside the same app now but however when i am running the search index="_internal" log_level=ERROR "test.csv" i am still seeing the error.

The lookup table 'test.csv' requires a .csv or KV store lookup definition.

Thanks

[VatsalJagani]

@Roy_9 - This query (index="_internal" log_level=ERROR "test.csv") has nothing to do with lookup.

It seems you have Automatic lookup (props.conf) for automatic lookup, which is having similar permission issue, that's what causing it.

[Roy_9]

@VatsalJagani  thanks for your message, i just checked the automatic lookups and i don't see one created for test.csv, Am i missing something? Do i need to check somewhere else? please help me

[VatsalJagani]

@Roy_9 - Give me your exact search please.

[Roy_9]

Hello @VatsalJagani 

I have the lookup table file and definition where the permissions are set to app level and when i am running the search inside app, it is fetching results but when i am running it in the main search and reporting app i am getting the error this lookup table requires a .csv or kvstore lookup defintion, how do we need to fix this error any idea?

Thanks

[VatsalJagani · Accepted solution]

@Roy_9 - Yes, you need to set the Lookup file and Lookup definition permission to set as "Global" instead of Private or App.

You can do that from from UI on their respective page under Settings on Splunk.

I hope this helps!!! Kindly upvote if it does!!!

[Roy_9]

@yeahnah even after deleting and recreating the lookup definition wouldn't help. i am still seeing the issue. i tired in GUI.

[yeahnah]

Hi @Roy_9 

Assuming the lookup file is called test.csv, does this command work?

| inputlookup test.csv

If so, it would indicate a problem with the lookup definition.  Maybe try deleting and recreating it.

Hope that helps