Hello all, I use Splunk API in order to export an SPL search. All queries are working well on my local dev environment and most work on production server. All queries that include or read from a certain query (let's call it "SessionEntities") seem to return empty. For instance the query, " | inputlookup SessionEntities", returns empty. The same query works both localy and even stranger, works on Splunk search page on the same server, while with the same query and different lookup, it returns with results. That lookup is no different than the others (no bigger content size), but still. Anyone has an idea of why could this be happening?
... View more