- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Splunk Lookups Return Error Even When Permissions ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Lookups Return Error Even When Permissions Are Global
I created a lookup and it was created under a specific app and I pointed it to a particular sourcetype.
When setting the permissions to allow all apps to access the lookup, why then can the other apps not see this lookup (other apps are using the same sourcetype).
I had to recreate each of my lookups 3 times in order to not get the error that the lookup could not be found.
Are permissions broken for lookups?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you set the permissions to global for all three components of the lookup?
- the lookup file
- the lookup definition
- the automatic lookup definition
If any one of these is not global, then the lookup will not work globally.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Would the fact that the data it is tied to(index) is on a master instance have any affect?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All set to App .. more specifically: This app only (system)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, the lookup file can be in the app directory. The metadata is set to export the file globally.
Next question - what are the permissions on the app itself?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The lookup file remained in the specific app lookup folder even after changing it to global. Could this be the issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where was the lookup file present? In global location i.e. system\lookup or the specific app lookup folder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
They were all set global, I have tried this on multiple splunk instances.
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
