topic Re: Update lookup files in Splunk Search

Update lookup files

karthik7411 — Tue, 10 Jul 2012 15:32:19 GMT

hi, i have already uploaded a csv lookup file to the splunk indexer. Now i want to add more entries to the csv file. i goto the destination where it is stored on the indexer and open it and edit and save it and restart splunk. then from my web interface if i do a | input lookup the newly added entries are not displayed. Can some one help me out??

Thanks in Advance!!!

Re: Update lookup files

Kate_Lawrence-G — Tue, 10 Jul 2012 19:05:13 GMT

Hi,

Lookup tables are typically stored at the search head and not the indexer. Is this an indexer & search head instance (i.e. doing both?)

You can verify lookups from the search head by going under the Manager -> Lookups ad see where you file is listed and can verify the file contents by logging into the box and taking a look at that path.

@Kate