I configured external lookup definition with a script I built. However, the lookup command fails with the following message.
Error in 'lookup' command: The lookup table 'mylookup' does not exist or is not available.
... | lookup mylookup myfield
[mylookup] external_cmd = get_lookup.py fields_list =Title,Genre,Country,imdbRating
I placed getlookup.py in $SPLUNKHOME/etc/apps/myapp/bin/.
What's wrong with the lookup definition?
(Splunk Ver: 6.5 / OS: Mac OS X)