Can you help us with the following Lookup table error: "ERROR LookupOperator - Error in 'lookup' command"

[evertonpsp]

Can anyone help me with error below?
...

11-06-2018 16:34:19.371 WARN  LookupOperator - Failed to find static lookup file: mmcb_ad_accounts.csv
**11-06-2018 16:34:19.371 ERROR LookupOperator - Error in 'lookup' command: Lookups: The lookup table 'mmcb_ad_accounts' does not exist or is not available.**
11-06-2018 16:34:19.371 ERROR SearchPhaseGenerator - Fallback to two phase search failed:Error in 'lookup' command: Lookups: The lookup table 'mmcb_ad_accounts' does not exist or is not available.
11-06-2018 16:34:19.372 ERROR SearchOrchestrator - Error in 'lookup' command: Lookups: The lookup table 'mmcb_ad_accounts' does not exist or is not available.
11-06-2018 16:34:19.372 INFO  SearchStatusEnforcer - Enforcing disk quota = 104857600
11-06-2018 16:34:19.374 INFO  UserManager - Unwound user context: opuser -> NULL
11-06-2018 16:34:19.376 INFO  UserManager - Unwound user context: opuser -> NULL
11-06-2018 16:34:19.376 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'lookup' command: Lookups: The lookup table 'mmcb_ad_accounts' does not exist or is not 

[marycordova]

How is the lookup file mmcb_ad_accounts.csv created and where is it stored? Also...if this is on linux what are the file permissions and what are the permissions on the file in the Splunk UI as well?

[evertonpsp]

Hi Mary,
I feel happy to have your help. Thanks in advanced!

The file mmcb_ad_accounts.csv is create by Splunk job and update every day at 00h. The OS the server where the file is store is Linux. Bellow the file permissions:

-rw------- 1 root root 101669 Nov 7 00:01 mmcb_ad_accounts.csv

In Splunk GUI, the file settings are as follows:

Object should appear in:
All apps

Permissions:
Read: Everyone Roles
Write: admin and power Roles

Additional Notes:

The problem happens with users belonging to Role user_service_desk.
For users belonging to Role admin, the problem does not occur.

If I edit the Role user_service_desk and include in the Inheritance field the Role admin, the problem no longer happens for Role users user_service_desk

Best regards!