https://community.splunk.com/t5/Getting-Data-In/How-to-Upload-a-dynamic-CSV-file-into-SPLUNK/m-p/175916#M35298 <P>Hello</P> <P>If it is a file that is beign updated continuosly, probably it would be better to simply index the file everytime it changes. So using a UF an a monitor stanza you will index the file everytime it changes maybe yo need to use CHECK_METHOD = modtime in your props.conf).</P> <P>Then you can use the indexed data to do the lookup, using join command for example</P> <P>EDIT: Take a look at this:</P> <P><A href="https://wiki.splunk.com/Dynamically_Editing_Lookup_Tables">https://wiki.splunk.com/Dynamically_Editing_Lookup_Tables</A><BR /> Regards</P> Thu, 12 Dec 2013 11:30:05 GMT gfuente 2013-12-12T11:30:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-Upload-a-dynamic-CSV-file-into-SPLUNK/m-p/175915#M35297 <P>Hi,</P> <P>I have a CSV file which is dynamically updated by a Macro (every 7 mins). This csv file is used as a inputlookup to search a list of domains in SPLUNK. <BR /> Currently, if I have to update the csv file in SPLUNK, I need to delete the existing csv file stored in splunk and manually upload the Macro updated csv file. <BR /> Please let me know if this process can be automated.</P> <P>Note: The csv is stored in Manager» Lookups» Lookup table files.</P> <P>Regards,</P> <P>Santhosh</P> Thu, 12 Dec 2013 06:33:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Upload-a-dynamic-CSV-file-into-SPLUNK/m-p/175915#M35297 santhosh2kece 2013-12-12T06:33:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-Upload-a-dynamic-CSV-file-into-SPLUNK/m-p/175916#M35298 <P>Hello</P> <P>If it is a file that is beign updated continuosly, probably it would be better to simply index the file everytime it changes. So using a UF an a monitor stanza you will index the file everytime it changes maybe yo need to use CHECK_METHOD = modtime in your props.conf).</P> <P>Then you can use the indexed data to do the lookup, using join command for example</P> <P>EDIT: Take a look at this:</P> <P><A href="https://wiki.splunk.com/Dynamically_Editing_Lookup_Tables">https://wiki.splunk.com/Dynamically_Editing_Lookup_Tables</A><BR /> Regards</P> Thu, 12 Dec 2013 11:30:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-Upload-a-dynamic-CSV-file-into-SPLUNK/m-p/175916#M35298 gfuente 2013-12-12T11:30:05Z