Updated lookup tables not reflected in the UI

[LiquidTension]

After updating some lookup tables that define a server, its alias, and the environment it is apart of (stage, dev, prod, etc) and pushing the change via deployment manager we are not seeing the change reflected in the UI when performing an inputlookup on the file. I have also validated that the change was pushed...when I manually look at the file the change is present on the search heads. A restart of the search head has also not resolved the issue. Has anybody else experienced this?

[jkat54]

There are permissions on the lookup as well. Not the file, but the lookup itself within Splunk. You can give it private, app level, or global.

[LiquidTension]

Here are the current permissions on each file:
-rw------- 1 splunk splunk 1815
-rw------- 1 splunk splunk 3667

[jkat54]

Permissions on the lookup could be the issue.

I'm thinking you need to run this a couple of times though:

 |extract reload=T

If that doesnt work, you can hit the REST API Endpoint (6.1.2 this exists, possibly earlier versions as well):

curl -k -u adminuser:password https://localhost:8089/services/admin/lookup-table-files/_reload   

Make sure you put in an appropriate username/pass

A restart of the search head should have done the above though... so check the permissions on the file as well as on the lookup.

[pradeepkumarg]

what are the permissions on the lookup? is it private, app or global?

[LiquidTension]

I just tried both of the above suggestions and still have the same problem unfortunately.

[pradeepkumarg]

Did you check the permissions on the lookup?