https://community.splunk.com/t5/Splunk-Search/Generate-lookup-files-via-webservices/m-p/67493#M16861 <P>Hi there,</P> <P>I want to avoid to copy via scp files on my cloudsearch for using them in lookups.<BR /> Is it possible to create lookup files by using API or some other webservices?</P> <P>Thanks in advance</P> Tue, 05 Jun 2012 10:08:31 GMT nebel 2012-06-05T10:08:31Z https://community.splunk.com/t5/Splunk-Search/Generate-lookup-files-via-webservices/m-p/67493#M16861 <P>Hi there,</P> <P>I want to avoid to copy via scp files on my cloudsearch for using them in lookups.<BR /> Is it possible to create lookup files by using API or some other webservices?</P> <P>Thanks in advance</P> Tue, 05 Jun 2012 10:08:31 GMT https://community.splunk.com/t5/Splunk-Search/Generate-lookup-files-via-webservices/m-p/67493#M16861 nebel 2012-06-05T10:08:31Z https://community.splunk.com/t5/Splunk-Search/Generate-lookup-files-via-webservices/m-p/67494#M16862 <P>You have two options as I see it. </P> <P>You either have to fetch the data for lookup from outside of Splunk using something like SCP + some parsting or call a python program to look the data up in real time. </P> <P>You need to consider the performance impact. You could always implement some kind of caching strategy with your python program if the data is rather static.</P> <P>Here's an example props and transform</P> <PRE><CODE>[mylookup] LOOKUP-bucket_lookup=lookup_buckets narrative account OUTPUT bucket </CODE></PRE> <PRE><CODE> [lookup_buckets] external_type = python external_cmd = bucket_lookup.py fields_list = narrative,account,bucket </CODE></PRE> <P>If you are planning to call a SOAP web service from Python I'd suggest you use SUDS.</P> Tue, 05 Jun 2012 10:27:22 GMT https://community.splunk.com/t5/Splunk-Search/Generate-lookup-files-via-webservices/m-p/67494#M16862 Marinus 2012-06-05T10:27:22Z