Why is the AWS Lookup failing in Splunk Enterprise Security?

[pfabrizi]

I have a customer that is running a search in ES training to use an AWS Account Look up table and it they get
The lookup table 'aws_account_names' does not exist. It is referenced by configuration 'aws:cloudtrail'.

but it works from core Splunk.

Is this a permissions issue or is the AWS app not available to ES?

Thank You!

[rpille_splunk · Accepted solution]

You need to take some additional steps to make other apps and add-ons accessible from ES.

See http://docs.splunk.com/Documentation/ES/5.0.0/Install/ImportCustomApps#Import_add-ons_with_a_differe... for instructions.

[pfabrizi]

Thank You!