When uploading an app CSV lookups do not appear in Splunk Cloud

bpal — Fri, 13 Nov 2020 16:03:32 GMT

I've built a Splunk App with lookups. On app upload the lookup definitions are created but the CSV are not.

App Folder Structure

my_app ├── bin │ ├── README │ └── app.manifest ├── default │ ├── app.conf │ ├── data │ │ └── ui │ │ ├── nav │ │ │ └── default.xml │ │ └── views │ │ └── README │ └── transforms.conf ├── lookups │ ├── test_falsePositive.csv │ └── test_metadata.csv └── metadata └── default.meta

default.meta

[] access = read : [ * ], write : [ admin, mgmt ] ### LOOKUPS [lookups] export = system [transforms] export = system

transforms.conf

[test_falsePositives] CAN_OPTIMIZE = 1 CLEAN_KEYS = 1 DEPTH_LIMIT = 1000 KEEP_EMPTY_VALS = 0 LOOKAHEAD = 4096 MATCH_LIMIT = 100000 MV_ADD = 0 SOURCE_KEY = _raw WRITE_META = 0 batch_index_query = 0 case_sensitive_match = 0 disabled = 0 filename = test_falsePositive.csv [test_metadata] CAN_OPTIMIZE = 1 CLEAN_KEYS = 1 DEPTH_LIMIT = 1000 KEEP_EMPTY_VALS = 0 LOOKAHEAD = 4096 MATCH_LIMIT = 100000 MV_ADD = 0 SOURCE_KEY = _raw WRITE_META = 0 batch_index_query = 0 case_sensitive_match = 0 disabled = 0 filename = test_metadata.csv

topic When uploading an app CSV lookups do not appear in Splunk Cloud in Splunk Dev

When uploading an app CSV lookups do not appear in Splunk Cloud