topic Re: If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app? in Splunk Search

If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app?

splunkrocks2014 — Tue, 02 Aug 2016 17:50:31 GMT

Assuming I have a lookup file, for instance, users.csv, with different contents and is located in different apps and shared globally. If I am running | inputlookup users.csv from "Search & Reporting", how does Splunk pick up the lookup file?

Re: If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app?

pradeepkumarg — Tue, 02 Aug 2016 18:38:41 GMT

Ideally you cannot create an object with same name via Splunk Web when another object already exists with same name and is shared globally. We've seen Splunk Web erroring out. But Splunk won't stop you doing this when you migrate an app from different splunk instance on the file system. We knew this would cause conflicts and
unexpected results for the searches and manually took care of deleting/removingduplicate objects (macros, lookups ) when we migrated apps around. Having said that, I don't have answer on what happens when you try to inputlookup. May be app name comes into precedence? Depends on what app you are running your search from? Worth testing.

Re: If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app?

somesoni2 — Tue, 02 Aug 2016 19:47:39 GMT

Have a look at how Splunk does the hierarchy of the configurations for app context here
http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Wheretofindtheconfigurationfiles#Summary_of_directory_precedence

Basically, local, app level sharing objects in current app will take preference over global objects in other apps.

$SPLUNK_HOME/etc/users/*

$SPLUNK_HOME/etc/apps/Current_running_app/local/*

$SPLUNK_HOME/etc/apps/Current_running_app/default/*

$SPLUNK_HOME/etc/apps/A/local/*, $SPLUNK_HOME/etc/apps/A/default/*, ... $SPLUNK_HOME/etc/apps/z/local/*, $SPLUNK_HOME/etc/apps/z/default/* (but see note below)

$SPLUNK_HOME/etc/system/local/*

$SPLUNK_HOME/etc/system/default/*

Re: If I have more than 1 lookup file with the same name, which file does Splunk pick up using inputlookup from the Search & Reporting app?

alexandermunce — Wed, 14 Dec 2016 04:45:03 GMT

The stanza relating to a particular lookup table should be unique to avoid any issues as mentioned above.