Thanks, That made me dig in the right place, leading to ... https://splunk.my.site.com/customer/s/article/User-is-getting-an-error-message-when  Essentially, ... it was found that all the lookups present in the app “Splunk_Security_Essentials” are added in denylist by default. Resolution to the error is to add local=true at the end of SPL command as below: ... | lookup isWindowsSystemFile_lookup filename local=true The indexers need a read-only copy of the knowledge bundle in order to run searches. Splunk Security Essentials brings a significant amount of data that does not need to be copied to the search heads. Adding "local=true", forces the lookup to run on the search head and not on any remote peer. That's ok for my purposes I think. ... View more