Why is a lookup working on one search head and not another?

[DavisLee]

How can I determine:

1) Why a Lookup is working on one search head but not on another?

2) How to get it to work on the second search head.

More detail:
I've been tasked with consolidating alerts on one search head. One of the alerts boils down to whether a macro containing the Lookup "thostinfo" works. I notice that on the SH it works, it is mentioned in "Searches, Reports, and Alerts"; on the SH where it doesn't it is not listed there.

I've found https://answers.splunk.com/answers/472888/splunk-app-for-windows-infrastructure-how-to-fix-t.html and wondered if the accepted answer would work. But I barely know enough to ask what questions I should be asking.

Many thanks.

[nickhills]

Is it possible that on the server where:

it is mentioned in "Searches, Reports, and Alerts"
That the search in question is actually a "populating search" which writes data to the csv?

Have you tried to see if Splunk can display the contents of the file using |inputlookup mylookup.cvs
If so - are the results the same on both search heads?

[somesoni2]

Check if the lookup or lookup definition exists in other search head (whatever is used in that alert). If lookup exists, check the sharing permissions of the lookup is same or not on both search heads.

[DavisLee]

The Lookup Definitions exist on both search heads and the permissions are the same.

Thank you

[lakshman239]

Are they both in the same app or in different app in both search heads? Also, what's the permission of the app and lookup? is that global OR app specific? In both the search heads, are you able to run something like |inputlookup yourlookupname.csv

from the Search app?