Splunk Search

Why does lookup file works for me but no on else?

just4bs
New Member

I have a .csv file that I have uploaded as a lookup file that works fine when I run a search.  If I ask another user to do the same search, it times out on them.  No error, it does nothing.   I have the permissions set for everyone read/write.  Should the permissions be different?

Labels (1)
Tags (1)
0 Karma

yeahnah
Motivator

Hi @just4bs 

It's not clear whether you shared the lookup file object into the app or globally too.  

yeahnah_0-1679441739227.png

If it is private then only you will see it.

Also, are you using a lookup definition or referencing the lookup directly.  If using a definition then you must ensure it is shared into the app, or globally too, along with read permission for other users.

Hope this helps

0 Karma

yeahnah
Motivator

Actually, rereading your question you say other users' query timeout, which is strange.  If it could not access the lookup then Splunk would report it as an error.

I suggest looking at the search.log of the query for clues

Job > Inspect Job

yeahnah_1-1679442220363.png

The click on search.log 

yeahnah_2-1679442268546.png

Look for ERROR or WARNING entries

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...