I have a .csv file that I have uploaded as a lookup file that works fine when I run a search. If I ask another user to do the same search, it times out on them. No error, it does nothing. I have the permissions set for everyone read/write. Should the permissions be different?
Hi @just4bs
It's not clear whether you shared the lookup file object into the app or globally too.
If it is private then only you will see it.
Also, are you using a lookup definition or referencing the lookup directly. If using a definition then you must ensure it is shared into the app, or globally too, along with read permission for other users.
Hope this helps
Actually, rereading your question you say other users' query timeout, which is strange. If it could not access the lookup then Splunk would report it as an error.
I suggest looking at the search.log of the query for clues
Job > Inspect Job
The click on search.log
Look for ERROR or WARNING entries