topic Re: Upload/update lookup file using rest API in Splunk Enterprise

Upload/update lookup file using rest API

jpillai — Fri, 14 Nov 2025 11:58:16 GMT

What is the recommended way to upload / update an existing lookup file through rest api.

I tried using lookup endpoints but it doesnt seem to be working.

https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.2/knowledge-endpoints/knowledge-endpoint-descriptions#id_888abd9e_5010_410e_a424_7384a9f13269__data.2Flookup-table-files

In short, I have a lookup file, abc.csv in search application under my ownership. I now need to overwrite with an updated file. How can we do this using rest api?

Re: Upload/update lookup file using rest API

PickleRick — Sat, 15 Nov 2025 14:58:51 GMT

Well... this is tricky because the endpoints for lookup table files require you to first upload the file to the server using another channel. Then with API you point Splunk to such file and it copies the file into its own directory.

You can't directly upload a lookup file into Splunk.

If I remember correctly, the lookup editor app had API which allowed for overwriting lookups directly but they might not be documented.

Re: Upload/update lookup file using rest API

burwell — Sun, 16 Nov 2025 07:24:36 GMT

Have a look at this solution

https://community.splunk.com/t5/Splunk-Search/Can-you-create-modify-a-lookup-file-via-REST-API/m-p/193699

@mthcht wrote a script that works. I modified it a little for my use but it is basically the same solution and works on a single head or on a SHC. The gist is that it loops through and reads the contents in python and then uploads a big string.