You have a couple of options. 1) If you have the permissions you can install a custom app that contains the csv in the app's lookups directory. The installation process will push the app to the searchheads as well as the indexers. That should resolve your "idx... lookup not found errors" 2) You can transition the lookup to a kvstore and configure replicate=true in transforms.conf  replicate = <boolean> * Indicates whether to replicate this collection on indexers. When false, this collection is not replicated on indexers, and lookups that depend on this collection are not available (although if you run a lookup command with 'local=true', local lookups are available). When true, this collection is replicated on indexers. * Default: false   However there are some default limitations regarding how many results can be returned for a search. Depending on the size of your lookup. But you can review those limitations here: https://docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Limitsconf#.5Bkvstore.5D ... View more