Why is Lookup definition in transforms.conf not returning results?

[_av]

I have created a lookup in the LOOKUP folder placed in local. Post that I defined the lookup in transforms.conf.

This is the stanza defined in transforms.conf

[lookup_name]

filename = lookup_name.csv

All the changes are pushed to dev repository in git but when I am trying to search the lookup in search head, I am unable to find the same. Is there any additional step that I am missing out on?

[jbrocks]

On which instance did you place the lookup file and how are you checking? If your lookup only exists on search head, then depending on your search, you might need to tell the lookup command so search local like: 

...|lookup local=t mylookup ...

[VatsalJagani]

Please make sure the following:

* You added the lookup file lookup_name.csv in the $SPLUNK_HOME/etc/apps/<app-name>/lookups directory.

* And you added the transforms.conf under $SPLUNK_HOME/etc/apps/<app-name>/local directory.

* Once you do that and perform Splunk restart run the below query from the same App (<app-name>) to see if your lookup loaded or not.

| inputlookup lookup_name

If you want to access your lookup from any App then you need to add the below stanza in $SPLUNK_HOME/etc/apps/<app-name>/metadata/local.meta (or you can use the default.meta)

[transforms]
export = system

[lookups]
export = system

* Further reference - https://dev.splunk.com/enterprise/tutorials/module_getstarted/setpermissions/