Lookup table "no matching fields exist" when the fields totally do exist

[jravida]

Hi folks,

I've been troubleshooting a lookup table (with global permissions shared with all apps) that hasn't worked for a certain group. Works great for me as admin, but not the user group I created. However when, as the user, I query:

| inputlookup mylookup.csv

I can clearly see the lookup table displayed with the fields and field names.

but within the query (say it is to lookup the car make from the car model):

| lookup mylookup.csv CARMODEL | table CARMODEL CARMAKE

returns nothing for the user group member

I can't for the life of me figure out why it isn't taking this data that it can view and pass it through to the query. I just get N/A in my panel, and when I view the search I see the "no matching fields exist" in the info button, yet I can view them as the user when i |inputlookup mylookup.csv

Any help greatly appreciated

[woodcock]

You are not using the correct syntax; try this:

| lookup mylookup.csv CARMODEL OUTPUT CARMAKE | table CARMODEL CARMAKE

[jravida]

I tried both and they both work for admin, neither work for the user

[woodcock]

A lookup has 3 parts (3 "knowledge objects"): The lookup, an entry in props.conf and an entry in transforms.conf. Each one of these must have the correct permissions for the user running the search or it will not work. Check all your permissions and you will find the problem.

[jravida]

I've checked the permissions for the lookup in-app, but in the back end, what permissions are required (Linux) for the props.conf and transforms.conf to work?

[woodcock]

I do not mean permissions at the file level in the OS (linux); I mean Knowledge Object permissions within Splunk. Go to "Settings" -> "All Configurations" and set "App Context" to "All" and "Owner" to "Any". Search for your lookup KOs. Look at the "Sharing" setting for each one and make sure that "Read" is checkmarked for "Everyone".