We're running Splunk 8.1.7.2. I am an admin. I have created a lookup file (my_lookup.csv), and lookup definition (my_lookup) referencing that file, in an app (my_app). Both the lookup file and definition have permission set to "All Apps (system)" and "Everyone Read", write is for admin only.
When I run the following searches I see contents of the lookup files as expected:
| inputlookup my_lookup.csv
OR
| inputlookup my_lookup
However, when my users attempts to run the search above, they get the following errors:
-"The lookup table 'my_lookup.csv' requires a .csv or KV store lookup definition."
-"The lookup table 'my_lookup' is invalid."
I don't understand how this could be. Also, it's worth pointing out the user used to be able to get results.
What permission or capability isn't set properly?
Any help is greatly appreciated. Thanks.
