topic Dynamic lookup file in Dashboards & Visualizations

Dynamic lookup file

MrJohn230 — Tue, 23 Jan 2024 21:23:51 GMT

I have a file that's updated every 5 minutes, it's populated my capturing a value in a URL using python code. (the value is "OK" or "bad"). I want to use the new file (that created every 5 minutes) in a splunk classic dashboard. I'm using the splunk cloud enterprise, and I'm not sure how to go about automating this process.

Is there a way to update/replace a file in the lookup table files? Or some other way I can go about adding in the new file after every refresh to the dashboard?

Re: Dynamic lookup file

PickleRick — Tue, 23 Jan 2024 21:39:36 GMT

Either Splunk Cloud or Splunk Enterprise. There is no such thing as Splunk Cloud Enterprise.

Also why do you want it to be a lookup? You can easily just use events in your table.

Re: Dynamic lookup file

gcusello — Wed, 24 Jan 2024 06:52:05 GMT

Hi @MrJohn230 ,

if you have a file so frequently updated, in my opinion, the best solution is to load every version of the file in an index and use as events, in this way, taking only the last version of the data, you'll always have updated data.

Ciao.

Giuseppe

Re: Dynamic lookup file

MrJohn230 — Wed, 24 Jan 2024 13:07:58 GMT

@PickleRick I'm using splunk enterprise. I wasn't sure of the best approach here, sounds like I can use events, not sure how I can go about doing this but I'll do more research.