I've built a Splunk App with lookups.  On app upload the lookup definitions are created but the CSV are not. App Folder Structure   my_app ├── bin │ ├── README │ └── app.manifest ├── default │ ├── app.conf │ ├── data │ │ └── ui │ │ ├── nav │ │ │ └── default.xml │ │ └── views │ │ └── README │ └── transforms.conf ├── lookups │ ├── test_falsePositive.csv │ └── test_metadata.csv └── metadata └── default.meta     default.meta   [] access = read : [ * ], write : [ admin, mgmt ] ### LOOKUPS [lookups] export = system [transforms] export = system     transforms.conf   [test_falsePositives] CAN_OPTIMIZE = 1 CLEAN_KEYS = 1 DEPTH_LIMIT = 1000 KEEP_EMPTY_VALS = 0 LOOKAHEAD = 4096 MATCH_LIMIT = 100000 MV_ADD = 0 SOURCE_KEY = _raw WRITE_META = 0 batch_index_query = 0 case_sensitive_match = 0 disabled = 0 filename = test_falsePositive.csv [test_metadata] CAN_OPTIMIZE = 1 CLEAN_KEYS = 1 DEPTH_LIMIT = 1000 KEEP_EMPTY_VALS = 0 LOOKAHEAD = 4096 MATCH_LIMIT = 100000 MV_ADD = 0 SOURCE_KEY = _raw WRITE_META = 0 batch_index_query = 0 case_sensitive_match = 0 disabled = 0 filename = test_metadata.csv     ... View more