Splunk Enterprise

What lookup permission or capability isn't set properly?

adamsmith47
Communicator

We're running Splunk 8.1.7.2. I am an admin. I have created a lookup file (my_lookup.csv), and lookup definition (my_lookup) referencing that file, in an app (my_app). Both the lookup file and definition have permission set to "All Apps (system)" and "Everyone Read", write is for admin only.

When I run the following searches I see contents of the lookup files as expected:
| inputlookup my_lookup.csv
OR
| inputlookup my_lookup

However, when my users attempts to run the search above, they get the following errors:
-"The lookup table 'my_lookup.csv' requires a .csv or KV store lookup definition."
-"The lookup table 'my_lookup' is invalid."

I don't understand how this could be. Also, it's worth pointing out the user used to be able to get results.

What permission or capability isn't set properly?

Any help is greatly appreciated. Thanks.

Labels (3)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...