Since there's no official solution, I share a sub-optimal solution I've come up with. It applies only to lookups, and is assuming your lookup table doesn't change very often. As an administrative user, you schedule a search in the form of |dbxquery ##### | outputcsv lookupname.csv Then in the filesystem of the search head, you establish a symbolic link between the spooled output file and the dir where lookups tables reside (for security reasons, outputcsv cannot write directly a lookup table, AFAIK) After doing this, you declare a standard csv lookup pointing to the symlink, and non-privileged users can use the standard | lookup lookupname.csv syntax ... View more

ME TOO. DB connect v1 was poor, but v2 implementation is even worse. ... View more

Meanwhile I've traced back the problem to an old (and forgotten) saved search. This search referenced a now-dismissed lookup csv and its presence was totally fine under splunk 6.3, but caused havoc in 6.5. ... View more

We too have the same problem, and we cannot wait until the end of January. If the error is caused by a defective configuration file, can you please share a script (or the instructions) to detect which file is defective?????? ... View more

I downvoted this post because using v1 should not be the accepted answer ... View more