https://community.splunk.com/t5/Splunk-Search/Can-a-lookup-be-recreated-and-use-the-existing-lookup-definition/m-p/608935#M211748 <P>The scenario is,&nbsp;</P> <P>A lookup csv has become unreadable. A lookup definition exists for it.</P> <P>The lookup was deleted and recreated. The existing definition was not changed.</P> <P>&nbsp;</P> <P>My question is: Can a lookup be recreated and use the existing lookup definition?</P> Wed, 10 Aug 2022 14:13:25 GMT leftinnerouter 2022-08-10T14:13:25Z https://community.splunk.com/t5/Splunk-Search/Can-a-lookup-be-recreated-and-use-the-existing-lookup-definition/m-p/608935#M211748 <P>The scenario is,&nbsp;</P> <P>A lookup csv has become unreadable. A lookup definition exists for it.</P> <P>The lookup was deleted and recreated. The existing definition was not changed.</P> <P>&nbsp;</P> <P>My question is: Can a lookup be recreated and use the existing lookup definition?</P> Wed, 10 Aug 2022 14:13:25 GMT https://community.splunk.com/t5/Splunk-Search/Can-a-lookup-be-recreated-and-use-the-existing-lookup-definition/m-p/608935#M211748 leftinnerouter 2022-08-10T14:13:25Z https://community.splunk.com/t5/Splunk-Search/Can-a-lookup-be-recreated-and-use-the-existing-lookup-definition/m-p/608941#M211753 <P>I lookup definition just points to a CSV on the file system. If that CSV is broken in some way and 'replaced' on the file system, then the new one will be used. It may required the Splunk environment to be refreshed, there may be a caching issue there, but if you are unable to refresh the environment easily, then simply upload the new CSV and change the associated filename in the lookup definition to use the new CSV. In a clustered environment the lookup will need to be propagated between the search heads during replication.</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 10 Aug 2022 03:15:46 GMT https://community.splunk.com/t5/Splunk-Search/Can-a-lookup-be-recreated-and-use-the-existing-lookup-definition/m-p/608941#M211753 bowesmana 2022-08-10T03:15:46Z