topic Re: How to update a lookup file in Splunk from Phantom? in Splunk Search

How to update a lookup file in Splunk from Phantom?

yadavameeth — Tue, 18 May 2021 12:25:45 GMT

How to update a lookup file in splunk from Phantom?

Re: How to update a lookup file in Splunk from Phantom?

MuS — Sun, 15 May 2022 00:47:36 GMT

Hi there,

we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file.

Hope this helps ...

cheers, MuS

Re: How to update a lookup file in Splunk from Phantom?

MuS — Thu, 02 Jun 2022 10:00:43 GMT

Okay, found the solution!

It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well.

Hope this helps ...

cheers, MuS

Re: How to update a lookup file in Splunk from Phantom?

PickleRick — Thu, 02 Jun 2022 12:13:38 GMT

You could also simply call REST API to update lookup contents.

Re: How to update a lookup file in Splunk from Phantom?

MuS — Fri, 03 Jun 2022 05:08:34 GMT

That did also not work for the same permission related reasons, but like I said it's working now.

cheers, MuS

Re: How to update a lookup file in Splunk from Phantom?

mthcht — Tue, 27 Dec 2022 15:19:56 GMT

Hi i made these scripts to update or upload lookups on splunk using lookup-editor endpoint

It can save the content of lookup(s) from splunk, add new fields and values or merge files and update them on splunk, you can use them in your playbooks