topic Re: Use Splunk SDK for Python to populate a lookup from a CSV file in Getting Data In

Use Splunk SDK for Python to populate a lookup from a CSV file

aflick2486 — Thu, 10 Aug 2017 18:53:23 GMT

I would like to populate the data inside of a lookup file from a .csv on a local computer. Is there a way to use the Splunk API or Splunk SDK for Python to to do this? Let me know if you need other information.

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

lfedak_splunk — Thu, 10 Aug 2017 20:30:35 GMT

Hey @aflick2486, Not sure if this helps, but here's a post on scripting a lookup with Python and the code has "import csv": https://answers.splunk.com/answers/145561/how-to-script-a-lookup-in-python.html

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

FritzWittwer_ol — Fri, 11 Aug 2017 06:41:13 GMT

You have to get the .csv file to the search head first, see this question and this question. If you can't put the file to the search head, I would try to use the rest api to create a search with ... | outpulookup xxx, this might work for a small file, or have a universal forwarder which indexes the local file, and then a search which reads the index and writes the .csv file with an outputlookup

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

starcher — Fri, 11 Aug 2017 17:22:57 GMT

If you really want to maintain a lookup via the rest API the lookup has to be a kvstore lookup. CSV lookups cannot be directly modified. You can use python to read in the csv file but use the REST API to control a kvstore lookup.