topic Re: How to outputlookup csv with permission? in Splunk Search

How to outputlookup csv with permission?

LearningGuy — Wed, 13 Sep 2023 20:31:57 GMT

Hello,
How to outputlookup csv with permission?
***Note that I am not Splunk admin - I only have access to Splunk GUI***
Please help. Thank you so much

For example:
| outputlookup test.csv

It will create test.csv in the following directory with no owner and sharing:Global
I am able to delete it, but I could not modify the permission.
How to outputlookup csv and set to sharing:App and I am the owner?

/opt/splunk/etc/apps/testapp/lookups/test.csv
Owner: No owner App: testapp Sharing: Global Status Enabled

Re: How to outputlookup csv with permission?

bowesmana — Thu, 14 Sep 2023 00:37:53 GMT

If this is a known consistent csv you are going to create, then create a new lookup of that name and upload a dummy csv. You can then define the permissions on the csv and outputlookup will then not change those permissions.

Re: How to outputlookup csv with permission?

LearningGuy — Thu, 14 Sep 2023 02:13:36 GMT

Hello,
I added a new lookup by uploading the CSV file by going to Lookups » Lookup table files » Add new
the CSV file was uploaded to this this directory and I can change the permission
/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv

When I used outputlookup, it wrote the same test.csv file into a different directory below and I cannot change the permission.
/opt/splunk/etc/apps/testapp/lookups/test.csv

Please suggest. Thank you

Re: How to outputlookup csv with permission?

bowesmana — Thu, 14 Sep 2023 03:22:29 GMT

This location means the lookup is private

/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv

which is the default state when you upload a lookup. You should change the permission to app before you do the outputlookup.

Re: How to outputlookup csv with permission?

LearningGuy — Thu, 14 Sep 2023 11:51:31 GMT

Hello,

You said "You should change the permission to app before you do the outputlookup"
Do you mean to change the permission to the app, not the CSV file?
If so, can you please give me an example? Note that I am not the admin
Thank you

Before outputlookup - no CSV file
After outputlookup - CSV file exists - but I cannot change the permission (it's greyed out)
/opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv

Re: How to outputlookup csv with permission?

bowesmana — Fri, 15 Sep 2023 00:17:19 GMT

When you said you did this

I added a new lookup by uploading the CSV file by going to Lookups » Lookup table files » Add new the CSV file was uploaded to this this directory and I can change the permission

When you upload the CSV the list of lookups will show your lookup as private

you can then change the permissions to app, which MOVES the file system location of that file to the location inside the app.

Then when you run outputlookup, you will be updating the one in the app folder, which you have previously set to app permission.

Re: How to outputlookup csv with permission?

LearningGuy — Fri, 15 Sep 2023 13:51:18 GMT

Your suggestion worked!!
Thank you so much for your help