topic Re: What is the path for input files in Getting Data In

What is the path for input files

randymw59 — Wed, 17 Dec 2014 18:51:19 GMT

I am new to Splunk...I have been given a query that uses an input file. I know the name of the input file, but how can I find the full pathname of where that file resides?

Re: What is the path for input files

esix_splunk — Wed, 17 Dec 2014 19:03:19 GMT

Depending on how the file is ingested, the source field will typically give you the full path of the file. If you can provide and example of what you are looking at, we can provide more concrete help...

Re: What is the path for input files

randymw59 — Mon, 28 Sep 2020 18:23:29 GMT

Here is the line in my query that reads the input file:
| inputlookup generic_ids_dcs.csv |

It doesn't list the entire pathname of the "generic_ids_dcs.csv" file, which is what I'm looking for.

Thanks....

Re: What is the path for input files

esix_splunk — Mon, 28 Sep 2020 18:23:31 GMT

This a from a lookup file, not an indexed data source. You need to look in the configuration, under lookup files, and find the lookup file to find out where on disk this is located.

Alternatively, if you have shell access on the box, you can do a find command or 'splunk btool transforms list --debug' and look for the "generic_ids_dcs.csv" lookup and path definition.

Re: What is the path for input files

randymw59 — Wed, 17 Dec 2014 19:13:21 GMT

I don't know how to look in the configuration / lookup files...

Re: What is the path for input files

randymw59 — Mon, 28 Sep 2020 18:23:34 GMT

I did find this:

/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv

How can I map the full pathname? I'm not sure where the /opt resides.

Re: What is the path for input files

somesoni2 — Wed, 17 Dec 2014 19:23:43 GMT

The file that you're looking is lookup table path. Use following query to get the full path

| rest /services/data/lookup-table-files | rename eai:* as * | table title acl.app data

The path will exist on the Search Head server. (/opt represent its the UNIX server)

Re: What is the path for input files

esix_splunk — Mon, 28 Sep 2020 18:23:37 GMT

That is the full pathname, including the filename, of the lookup file. What do you mean by map?

You can add this path via an eval as

..currentsearch.. | eval mappedpath="/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv"

And then do what you want to it..

Re: What is the path for input files

randymw59 — Mon, 28 Sep 2020 18:23:39 GMT

I've been able to identify the path as:

/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv

Can I edit the file in Splunk, or is it only possible to edit the file outside of Splunk in another editor program?

Re: What is the path for input files

esix_splunk — Wed, 17 Dec 2014 20:32:07 GMT

You can edit this in splunk with the lookup editor app, which has to be downloaded an installed from apps.splunk.com. You can also edit locally and upload the new copy to the splunk server, but you have to have permissions assigned to be able to do this. The other option is editing it in the local file system.