I've been troubleshooting a lookup table (with global permissions shared with all apps) that hasn't worked for a certain group. Works great for me as admin, but not the user group I created. However when, as the user, I query:
| inputlookup mylookup.csv
I can clearly see the lookup table displayed with the fields and field names.
but within the query (say it is to lookup the car make from the car model):
| lookup mylookup.csv CARMODEL | table CARMODEL CARMAKE
returns nothing for the user group member
I can't for the life of me figure out why it isn't taking this data that it can view and pass it through to the query. I just get N/A in my panel, and when I view the search I see the "no matching fields exist" in the info button, yet I can view them as the user when i |inputlookup mylookup.csv
Any help greatly appreciated
A lookup has 3 parts (3 "knowledge objects"): The lookup, an entry in props.conf and an entry in transforms.conf. Each one of these must have the correct permissions for the user running the search or it will not work. Check all your permissions and you will find the problem.
I do not mean permissions at the file level in the OS (linux); I mean Knowledge Object permissions within Splunk. Go to "Settings" -> "All Configurations" and set "App Context" to "All" and "Owner" to "Any". Search for your lookup KOs. Look at the "Sharing" setting for each one and make sure that "Read" is checkmarked for "Everyone".