https://community.splunk.com/t5/Getting-Data-In/Automatically-Get-Lookup-Table-with-Universal-Forwarder/m-p/150322#M30554 <P>You cannot forward data into a lookup table. Forwarded data goes into an index - there is no other choice.</P> <OL> <LI><P>You can use some other mechanism to place / update a CSV file in the Splunk indexers' lookup directory.</P></LI> <LI><P>OR, you could send the data to a different index using Splunk. And then you could export that data (using a scheduled search) into a Splunk lookup table. Or you could write your searches differently, so that they use both indexes and not a lookup table.</P></LI> </OL> <P>There might be other options, but I can't think of them. Frankly, I would probably go with option #1 if I could.</P> Fri, 12 Dec 2014 22:03:02 GMT lguinn2 2014-12-12T22:03:02Z https://community.splunk.com/t5/Getting-Data-In/Automatically-Get-Lookup-Table-with-Universal-Forwarder/m-p/150321#M30553 <P>Hello Splunk Verse,</P> <P>I was wondering if anyone could help solve a configuration challenge? My system admin's are wanting to index login-logout data to Splunk, (easy &amp; done), and we want to index a lookup table that the application will generate on the remote host. We would like this to be picked up by UF and then properly put into a global lookup table. This file will store application/login metadata. It will be utilized to validate that login's aren't abused. (So use the lookup table to define allowed login locations &amp; reverse match against the actual logs).</P> <P>I can't find in the documentation how to configure UF to grab the file &amp; index it to a lookup table. Can anyone help?</P> <P>Thanks!</P> Fri, 12 Dec 2014 21:14:58 GMT https://community.splunk.com/t5/Getting-Data-In/Automatically-Get-Lookup-Table-with-Universal-Forwarder/m-p/150321#M30553 ltrand 2014-12-12T21:14:58Z https://community.splunk.com/t5/Getting-Data-In/Automatically-Get-Lookup-Table-with-Universal-Forwarder/m-p/150322#M30554 <P>You cannot forward data into a lookup table. Forwarded data goes into an index - there is no other choice.</P> <OL> <LI><P>You can use some other mechanism to place / update a CSV file in the Splunk indexers' lookup directory.</P></LI> <LI><P>OR, you could send the data to a different index using Splunk. And then you could export that data (using a scheduled search) into a Splunk lookup table. Or you could write your searches differently, so that they use both indexes and not a lookup table.</P></LI> </OL> <P>There might be other options, but I can't think of them. Frankly, I would probably go with option #1 if I could.</P> Fri, 12 Dec 2014 22:03:02 GMT https://community.splunk.com/t5/Getting-Data-In/Automatically-Get-Lookup-Table-with-Universal-Forwarder/m-p/150322#M30554 lguinn2 2014-12-12T22:03:02Z