topic How to update a lookuptable? in Splunk Search

How to update a lookuptable?

Abass42 — Mon, 20 Mar 2023 22:01:02 GMT

So I couldn't find anything in splunk community that answers my question about pushing an update to a lookup table. I manually updated the .csv file through the backend searchhead server. I deleted a line and replaced it with another hostname.

When i run the command:

Im still getting the host that has a count of 0, the host that i removed in the csv file. My question is do i need to restart the searchhead to push that change? I didnt change any config files, just the lookupfile under the specific app directory's lookup file folder. I wasnt sure if splunk would automatically read the updated file after a certain amount of time, or if i needed to restart the server for it to take effect? And will that file replicate across all searchheads after I restart it?

Thank you for any guidance.

Re: Updating a lookuptable

PickleRick — Mon, 20 Mar 2023 18:11:01 GMT

1) If you do manual changes to the files on splunk nodes, sometimes they get reloaded on their own, sometimes they don't (they usually do in the end but it may take some time). It's better to force a refresh. See https://community.splunk.com/t5/Security/When-you-run-debug-refresh-what-does-it-refresh/m-p/610498

Some settings however are never applied without full restart.

2) If you have a search-head cluster, you should push your changes via the deployer. If however you have several non-connected search-heads, you have to apply the config change to each one of them. Either manually or - if you're using deployment server - by distributing new version of an app via DS.

Re: Updating a lookuptable

somesoni2 — Mon, 20 Mar 2023 19:00:58 GMT

Splunkbase has a great app for updating lookup table from UI.

https://splunkbase.splunk.com/app/1724

This uses REST APIs I believe so updates do not require refresh/restart. Check that app out.

Re: Updating a lookuptable

PickleRick — Mon, 20 Mar 2023 19:28:19 GMT

That's another story 😉 But yes, the app is quite useful (even if a bit clunky).