Splunk Search

db lookup not found

a212830
Champion

Hi,

I just added a db lookup (via db connect), and when I try to use it via a search, I get a "lookup table does not exist" message. It's there, and when I execute the sql via a dbquery, it returns data. Is there another required step?

Tags (2)

chanst2
Path Finder

Not sure if you are using the same user that created the db lookup to make the search. I was able to get the lookup table when I used the same user. However, when I use a user with fewer capabilities, I got the same problem.

I added the dbx_user role to the user who has to search with this db lookup and it worked. However, it will expose the "External Database" section to that user. I'm still finding ways to avoid this while letting that user use the db lookup.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...