topic Lookup file updates not working in Getting Data In

Lookup file updates not working

jiaqya — Fri, 06 Apr 2018 07:39:12 GMT

I have a lookup created from a CSV file.

i put in entries
1
2
3
4
5

When i do a search, i can find these values.

now ,next day i add a new entry 6 and save the csv file.

i dont see the search showing 6, it only shows 1-5

can you help me fix this, it seems the lookup file updates are not being honored...

Re: Lookup file updates not working

splunker12er — Fri, 06 Apr 2018 07:43:12 GMT

you can place your lookup file in the below directory and can access from search query

location:

D:\Program Files\Splunk\etc\apps\search\lookups\example.csv

search query :

|inputlookup example.csv

Re: Lookup file updates not working

jiaqya — Fri, 06 Apr 2018 07:47:17 GMT

Yes, this is exactly how i have done it.
now when i do changes to this file, i dont see the changes.

|inputlookup file.csv

Re: Lookup file updates not working

jiaqya — Fri, 06 Apr 2018 07:59:04 GMT

Found the answer.

i had the same lookup name file from 2 different locations . i was updating one of the file and so that was considered by splunk as not primary , so it was not showing.

i delete the duplicate entry and now i can see the new entry...