To use a flat file lookup table is easy - simply create (say) a CSV file and use it with the search app syntax | inputlookup test.csv but if I go to Apps -> Lookups -> database lookups and create a new DB lookup... In this case a database table exists in an MS SQL database, local to the install of splunk (same machine) HIP7_SignameXlate I can get the GUI to query the DB (called ePO) to fill all the columns and save it. This suggests that the permissions etc are fine, and the DB connect app can read the table colums. Additionally, I can read data using a db tail, proving that the system returns data via the DB CONNECT app. However, the lookup table does not work. I get the following error: | INPUTLOOKUP dbo.HIP7_SigNameXlate The lookup table 'dbo.HIP7_SigNameXlate' is invalid. I know the spelling is correct as this is a cut and paste. Any ideas how to troubleshoot this? Thanks ... View more