Splunk API seach results - certain lookup returns empty, while others are functioning

[eshcharc]

Hello all,

I use Splunk API in order to export an SPL search.
All queries are working well on my local dev environment and most work on production server.

All queries that include or read from a certain query (let's call it "SessionEntities") seem to return empty.

For instance the query, " | inputlookup  SessionEntities", returns empty.

The same query works both localy and even stranger, works on Splunk search page on the same server, while with the same query and different lookup, it returns with results.

That lookup is no different than the others (no bigger content size), but still.

Anyone has an idea of why could this be happening?

[ITWhisperer · Accepted solution]

Is the lookup visible to the user you are authenticating with for the API call?

[eshcharc]

@ITWhisperer  Double checked, and it was indeed an issue of permissions of the lookup transform

A big thank from me for helping!

[eshcharc]

It seems to be no different than other working lookups on the same application. What else can I check other than the lookup's application permissions?