1) Why a Lookup is working on one search head but not on another?
2) How to get it to work on the second search head.
I've been tasked with consolidating alerts on one search head. One of the alerts boils down to whether a macro containing the Lookup "thostinfo" works. I notice that on the SH it works, it is mentioned in "Searches, Reports, and Alerts"; on the SH where it doesn't it is not listed there.
Check if the lookup or lookup definition exists in other search head (whatever is used in that alert). If lookup exists, check the sharing permissions of the lookup is same or not on both search heads.
Are they both in the same app or in different app in both search heads? Also, what's the permission of the app and lookup? is that global OR app specific? In both the search heads, are you able to run something like |inputlookup yourlookupname.csv