user is getting the following error:Could not load lookup=LOOKUP-h_vms

[Splunk-Star]

On splunk user is getting the following error:Could not load lookup=LOOKUP-pp_vms  but admin is not getting any such errors.

that look up file is not present also. What we need to do?

[isoutamo]

Hi

if/when admin can use it and regular user didn't then quite probably user hasn't permission to use it. Ask that your admin check those permissions. It should be shared (at least) app level and given read access to all needed roles or to everyone. If/when it has shared as app level then users must use it inside that app not from any other app. If it need to access from any app then it must shared globally.

r. Ismo

[gcusello]

Hi @Splunk-Star ,

this message means that the h_vms lookup, that you're using in a search, isn't present.

You should check if the name is correct: maybe you missed .csv extention or the name has some char in uppercase (lookup name is case sensitive).

If instead this lookup isn't present in your search, in the add-ons you're using there's this automatic lookup, but the lookup isn't present.

You could solve the issue adding a lookup with this name, but put again attention to the lookup name.

Ciao.

Giuseppe