https://community.splunk.com/t5/Splunk-Search/is-there-any-way-to-edit-an-app-level-lookup-table/m-p/25455#M4802 <P>I have a user who has created a lookup table and given it app-level permissions. Now the same user wants to add new entries to the lookup table. They can upload it as private, but cannot update the app-level table without deleting the existing one first. Any way around this that can be accomplished in the UI?</P> Fri, 03 Aug 2012 18:43:35 GMT bjalex80 2012-08-03T18:43:35Z https://community.splunk.com/t5/Splunk-Search/is-there-any-way-to-edit-an-app-level-lookup-table/m-p/25455#M4802 <P>I have a user who has created a lookup table and given it app-level permissions. Now the same user wants to add new entries to the lookup table. They can upload it as private, but cannot update the app-level table without deleting the existing one first. Any way around this that can be accomplished in the UI?</P> Fri, 03 Aug 2012 18:43:35 GMT https://community.splunk.com/t5/Splunk-Search/is-there-any-way-to-edit-an-app-level-lookup-table/m-p/25455#M4802 bjalex80 2012-08-03T18:43:35Z https://community.splunk.com/t5/Splunk-Search/is-there-any-way-to-edit-an-app-level-lookup-table/m-p/25456#M4803 <P>You have 3 methods to edit lookup</P> <UL> <LI>Access the lookup file in the filesystem</LI> <LI>Upload the new version of the lookup file in the UI (after changing the read permissions on the object in the UI)</LI> <LI>Or a third method is to use a search to update the lookup table. inputlookup mylookup | append [ search to add my new lines ] | dedup uniquefields | outputlookup mylookup</LI> </UL> <P>so if the issue is a permission issue, have an admin change the permissions on the lookup file/definition for a role, and add the user to this role.</P> Fri, 03 Aug 2012 19:09:31 GMT https://community.splunk.com/t5/Splunk-Search/is-there-any-way-to-edit-an-app-level-lookup-table/m-p/25456#M4803 mataharry 2012-08-03T19:09:31Z