How to resolve API Search Lookup ERROR?

[laauespinosa]

Hi, 

We are doing consults via API with the query: 

index=_internal sourcetype=splunk_python subject |fields subject,recipients | where subject like "%ORION%"'

But when we try to collect the results, give us an error from a lookup that is not part of the original search.

Via web the search is working fine, but the problem is via API.

Have you experienced something like that?

Thanks!

[schose]

Hi, 

when searching via API you are providing parameters:

cparams = { "host" : lconfig["host"],
"port" : lconfig["port"],
"username" : lconfig["user"],
"password" : lconfig["password"],
"app" : lconfig["app"] }

most propably you are not using same user or correct app context. 

check index=_audit and/or index=_internal sourcetype=splunkd_access + username..

best regards,

Andreas