In case you haven't got the answer for it: I faced the similar issue yesterday when I try to configure props.conf in the local directory. I copied everything from props.conf.example ( http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Propsconf ) and there we have : # The following example shows how to configure lookup tables [my_lookuptype] LOOKUP-foo = mylookuptable userid AS myuserid OUTPUT username AS myusername which was the root cause of this issue. I disabled it (put # in front of these lines) and restarted Splunk. Everything is working fine now. I am writing here to help someone who might face the same issue with Splunk 7x. ... View more