Hi Splunkers, for our customer we need to populate an external lookup. We are on a Splunk SaaS env.
A colleague has developed a simple app to achieve this purpose. After some test, the lookup seems to be populated fine.
Our current problem is: if we use this lookup in a search executed from Search and Reporting app, it return expected results. No issue, no missing data. But, if we try from another app able to execute a search (I mean, with search function available), on the same data set and time range, output is empty. We suspect it's related to a permission problem (may be the app has no permission to write on underlying file system, due we are in a cloud env?), but we are not sure. Moreover, even if we are right how could be fix the issue?
