The lookup command is a distributable streaming command when local=false, which is the default setting. And distributable streaming command runs on indexer servers. So in your second query lookup is running on indexer server: [IndexServerName] and failing as it is not created there. You need to provide local=true in lookup command to run it on search heads. index=myIndexFile | lookup local=true myserverlist my_host Why the first query works? it is using head command which is a centralized streaming command which only runs on search heads. Before head command executed indexers send the results to the search head and all the next commands will be run on search head only. So in this case lookup will be run on search head so it works. Check this link to understand this better: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Writebettersearches#Parallel_processing_example Check below links for more info: https://docs.splunk.com/Documentation/Splunk/8.0.2/Search/Typesofcommands https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Commandsbytype ... View more