Second Indexer/SearchPeer reports "The lookup table '{LOOKUP_TABLE}' does not exist. It is referenced by configuration '{APP}." but it does. What is causing this message?

[rgcurry]

I have defined a lookup table for one of my Apps and it is working perfectly. But if I go to a different App and issue a search, I get the error message "The lookup table '{LOOKUP_TABLE}' does not exist. It is referenced by configuration '{APP}." I have checked and the permissions on the lookup table are set to 'APP'.

I have also reviewed many of the previously asked questions on this site and none of the answers seem to fit my situation, or at least provide no resolution to this situation for me. I have looked at:

• Lookup does not exist =
  http://splunk-base.splunk.com/answers/28541/lookup-table-does-not-exist

• Splunk says lookup table does not exist, but it does =
  
  http://splunk-base.splunk.com/answers/10630/splunk-says-lookup-table-doesnt-exist-but-it-does

• user_lookup table does't exist =
  
  http://splunk-base.splunk.com/answers/12078/user_lookup-table-doest-exist

What else do I need to look at in my system to resolve this "problem"?

[coleman07]

This is the most odd behavior and most counter intuitive thing I have seen. I had the opposite problem. I wanted to share my props and transform for a lookup for a different app so I set both the file and the automatic lookup to global and it didn't work. I set the automatic lookup to app and it works fine now. Why it wouldn't work with global makes no sense to me.

[lguinn2 · Accepted solution]

Lookups have permissions, just like other knowledge objects. Both the lookup file AND the lookup definition have permissions, in fact.

Edit permissions for both of these to make them available globally. I think that will solve your problem. At the moment, your lookup belongs to a single app and is visible only to that app. (Or maybe your lookup is global but the lookup file belongs to a single app.)

BTW, you must have Splunk admin role to assign global permissions. Otherwise, you can only share within a single app.

[lguinn2]

My guess is that you set up an automatic lookup for a source or sourcetype. Now Splunk wants to run the lookup even when you are working in a different App.

I understand your thinking "I defined the lookup in an App. It should only run the lookup when I am using that App." That makes sense to me, but I don't think that is how it works.

Or maybe there is a more complicated reason that I just can't see.

[rgcurry]

I get that resolves this issue. What I am not clear on is how it is I must do this when the data in the lookup table is specific to this App and irrelevant to the others. Do you have 'inside' info on how this needs to be this way? Curious minds want to know! (8->)

BTW -- Thanks for your time and excellent assistance on this.

[lguinn2]

Yep, just update them to global and you should be good to go!

[rgcurry]

I have checked and verified all three permissions for the table and confirmed they are set to "App". I do confess that I did that as I was entering this post but continued with it and submitted it after confirming. Great thought and a logical one at that, thanks.