External lookup script not functioning in search app

[kelambert]

I have an external lookup using a python script. It is in its own app, but is shared to all apps with R/W access. The app's .meta file has props, transforms, and lookup set with export = system.
When the lookup is called in several dashboards and saved searches it works fine. When in search app, if using the exact search from the dashboard or saved search the lookup works, but if the search is changed or the lookup is used in a different search it returns "Error in 'lookup' command: The lookup table 'whois' does not exist"

[kelambert]

Our environment is a distributed environment meaning that indexers are on a different server than the search head. When performing searches in a distributed environment everything prior to the transforming portion of the search happens on the indexer and everything after the transforming search happens locally on the search head as it has already retrieved the data from the indexer.

My lookup configuration add-on was only located on the search head server but I wasn't performing a transforming search so it was trying to run the lookup on the indexers where the add-on was not located.

http://docs.splunk.com/Splexicon:Transformingsearch

[kelambert]

Please disregard. I found that since I was only performing a search then immediately piping into the lookup it was failing. When I first performed an action which tabled the data or converted it from raw logs in some form (top,table etc.)then it performed thelookup without error. Though "Error in 'lookup' command:lookup table 'foo' does not exist" is a bit misleading.