Splunk Search

Why is a lookup working on one search head and not another?

New Member

How can I determine:

1) Why a Lookup is working on one search head but not on another?

2) How to get it to work on the second search head.

More detail:
I've been tasked with consolidating alerts on one search head. One of the alerts boils down to whether a macro containing the Lookup "thostinfo" works. I notice that on the SH it works, it is mentioned in "Searches, Reports, and Alerts"; on the SH where it doesn't it is not listed there.

I've found https://answers.splunk.com/answers/472888/splunk-app-for-windows-infrastructure-how-to-fix-t.html and wondered if the accepted answer would work. But I barely know enough to ask what questions I should be asking.

Many thanks.

Tags (2)
0 Karma

Ultra Champion

Is it possible that on the server where:

it is mentioned in "Searches, Reports, and Alerts"
That the search in question is actually a "populating search" which writes data to the csv?

Have you tried to see if Splunk can display the contents of the file using |inputlookup mylookup.cvs
If so - are the results the same on both search heads?

If my comment helps, please give it a thumbs up!
0 Karma

Revered Legend

Check if the lookup or lookup definition exists in other search head (whatever is used in that alert). If lookup exists, check the sharing permissions of the lookup is same or not on both search heads.

0 Karma

New Member

The Lookup Definitions exist on both search heads and the permissions are the same.

Thank you

0 Karma


Are they both in the same app or in different app in both search heads? Also, what's the permission of the app and lookup? is that global OR app specific? In both the search heads, are you able to run something like |inputlookup yourlookupname.csv

from the Search app?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.