topic Re: Edit a lookup file through the REST API in Splunk Search

Edit a lookup file through the REST API

rolyrolex — Thu, 07 Oct 2021 08:49:01 GMT

Hello !!

I am new to using splunk and would like to know if it is possible to edit a lookup file via Splunk REST API or lookup editor API ?

Thank y'all

Re: Edit a lookup file through the REST API

richgalloway — Thu, 07 Oct 2021 19:26:47 GMT

There is no API for updating parts of a lookup file. You must replace the whole thing. See the REST Reference Manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTknowledge#data.2Flookup-table-files.2F.7Bname.7D

Re: Edit a lookup file through the REST API

PickleRick — Thu, 07 Oct 2021 21:00:52 GMT

In general, it's not possible to update parts of a file-based lookup. You can overwrite whole lookup file (either by REST API or outputlookup command). You can of course edit the file directly on the server(s) but it will also effectively work as complete replacement of old contents when splunk reloads the lookup file.

Re: Edit a lookup file through the REST API

rolyrolex — Mon, 11 Oct 2021 07:56:01 GMT

Thank you all for your responses.

I think I should fully explain what I would like to do to find out if this is possible.

we have lookup file configurations in a Google Sheet, currently we are updating these configurations manually in the lookup files in splunk.

Now we want to automate the creation or modification directly from the google sheet.

So I would like to know if this is possible with splunk tools.

Thank you

Re: Edit a lookup file through the REST API

PickleRick — Tue, 12 Oct 2021 05:10:22 GMT

As we wrote - your process has to rewrite contents of the lookup completely.

As a matter of fact, I have a similar situation - my users supply data in .csv file put on a network share. I read this file as a delimited source file and push the events into a small auxiliary index. Then I do a scheduled report which reads the latest occurences of the events and ends with | outputlookup in order to write the results to a lookup. This way whenever my users put a new file into a well-known location, they get an updated lookup within few minutes.

EDIT: As a word of explanation - I could have done that perfectly well using external scripts and calling appropriate REST endpoint to refresh contents of the lookup file but in this case the point was that I wanted to do it entirely with built-in splunk functionality - without any external tools.

Re: Edit a lookup file through the REST API

rolyrolex — Wed, 13 Oct 2021 15:11:41 GMT

Thank you !!

Can i use this with splunk cloud ? or how do i put a file in the upload staging area ?