topic Re: How to Distribute and update "manually" created lookup file in the SHC? in Splunk Enterprise

How to Distribute and update "manually" created lookup file in the SHC?

NoSpaces — Wed, 16 Aug 2023 23:16:36 GMT

Hello to everyone.
I need to distribute a *.csv file that was created by a certain script (not with the help of Splunk).
The script runs every day and may update the file.
How can I do it in the SHC?
I tried to push this file with the help of the Deployer, but the main problem with this approach is that a lookup file is only created if it does not exist on the SHC members. If I push it once, I can't update it.

I understand that I can develop an external script that will delete an old file on the SHC members and then push a new one with the help of the Deployer.
But maybe an easier way exists to resolve my case?

Re: How to Distribute and update "manually" created lookup file in the SHC?

NoSpaces — Fri, 18 Aug 2023 06:52:47 GMT

Re: How to Distribute and update "manually" created lookup file in the SHC?

NoSpaces — Tue, 22 Aug 2023 10:58:15 GMT

Re: How to Distribute and update "manually" created lookup file in the SHC?

andrew_nelson — Tue, 22 Aug 2023 12:18:01 GMT

In your script, copy the file to SH1.yourdomain.com:/opt/splunk/var/run/splunk/lookup_tmp/ (C:\Program Files\Splunk\var\run\splunk\lookup_tmp\ on Windwos) on one of the SHs.
This puts it into the Splunk lookup staging directory.
Make sure to pick one of the search heads and not a domain alias for your environment. Knowing the exact SH that you copy the file to is important for the next step.

Then you can use the REST API to promote it to the production version of the lookup using the below endpoint:

curl -k -u admin:pass https://SH1.yourdomain.com:8089/servicesNS/<user>/<app>/data/lookup-table-files/lookup_file_name.csv -d eai:data=/opt/splunk/var/run/splunk/lookup_tmp/new_lookup_file_name.csv

If the lookup is to be shared in the app, you can set the user to nobody.

This API call checks the staging area for a CSV called new_lookup_file_name.csv and overwrites the lookup_file_name.csv in production.

Since its elevated via the Splunk API, Splunk takes care of the replication to other SHs in the cluster.

Documentation on this can be found here: Knowledge endpoint descriptions - Splunk Documentation

Re: How to Distribute and update "manually" created lookup file in the SHC?

NoSpaces — Tue, 29 Aug 2023 08:00:56 GMT

Thank you for the workaround
I will check out this approach

Re: How to Distribute and update "manually" created lookup file in the SHC?

splunkreal — Fri, 06 Feb 2026 14:12:22 GMT

Hello @andrew_nelson it looks complicated, is it supported by Splunk using this method?

Re: How to Distribute and update "manually" created lookup file in the SHC?

andrew_nelson — Fri, 06 Feb 2026 15:02:46 GMT

Hey @splunkreal

Yeah, its supported. All documented in the REST API documentation.
Knowledge endpoint descriptions | Splunk Enterprise

Check out POST data/lookup-table-files

The only extra steps I added was for dealing with a search head cluster as the initial post was related to SHC.

Re: How to Distribute and update "manually" created lookup file in the SHC?

PickleRick — Fri, 06 Feb 2026 22:40:50 GMT

Alternatively you could use Lookup Editor's API. It's not officially documented but there are examples of scripts using it on the web.