topic Re: Update a lookup file via REST in Getting Data In

Update a lookup file via REST

Damien_Dallimor — Fri, 17 Feb 2012 01:25:43 GMT

I want to be able to update an existing csv lookup file (that resides within the lookups directory of a custom app on a searchhead) by uploading the updated file from the local machine(via a custom widget that uses the REST api)

I see there is a REST endpoint similar to this but requires the the lookup file to be published to a staging area on the Splunk server and doesn't allow you to target the destination app.

Re: Update a lookup file via REST

Ayn — Mon, 20 Feb 2012 21:30:47 GMT

There's another REST endpoint that seems to be addressing this exact thing: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTknowledge#POST_data.2Ftransforms.2Flookups.2F.7Bname.7D

Re: Update a lookup file via REST

Damien_Dallimor — Mon, 20 Feb 2012 21:44:44 GMT

I don't see how this endpoint can be used to update an existing csv file, as in the contents of the existing lookup file.
The endpoint you mentioned is just for updating the lookup definition.

Re: Update a lookup file via REST

Ayn — Mon, 20 Feb 2012 21:47:32 GMT

Hm, true. Sorry!

Re: Update a lookup file via REST

ziegfried — Wed, 22 Feb 2012 08:48:26 GMT

You could add a custom REST endpoint to Splunk that handles the file upload and updates the lookup CSV file.

Re: Update a lookup file via REST

Damien_Dallimor — Wed, 22 Feb 2012 10:09:53 GMT

Cheers Z... I think that will be the approach.

Re: Update a lookup file via REST

twinspop — Tue, 10 Dec 2013 18:32:32 GMT

Did you ever create this functionality? Can you share?