topic Re: Lookup: CSV file in Splunk Search

Lookup: CSV file

htkwan — Tue, 15 Mar 2016 13:34:38 GMT

Hello,
I've configured lookup, using a csv file. I've loaded the csv file, configure the lookup definition & automatic lookup. It works okay. When there are changes in th csv file (i.e. add in new rows), how can i do a reload? Thanks.

Re: Lookup: CSV file

DMohn — Tue, 15 Mar 2016 14:05:37 GMT

You can either restart your Splunk server, or use the debug/refresh URL ...

 http://splunkweb-url:8000/en-US/debug/refresh

This command will reload many static entities, such as lookups, transforms, ....
You can as well trigger the lookup entity directl., which can be done by one of the following commands (I'm not sure if the first one is sufficient, hence both - but you could try with the first one only)

 http://localhost:8000/en-US/debug/refresh?entity=admin/lookup-table-files
 http://localhost:8000/en-US/debug/refresh?entity=admin/transforms-lookup

Re: Lookup: CSV file

somesoni2 — Tue, 15 Mar 2016 14:08:07 GMT

If you've access to file system on your Splunk servers, you can update the lookup csv file directly from path $SPLUNK_HOME/etc/apps/YourAppName/lookups folder, no reload required.

If you don't, then you can use lookup editor apps such as "Lookup File Editor App" OR Lookup Updater dashboard of Sideview Utils.

Last option would be to delete the lookup table file and re upload with same name with updated content.

Re: Lookup: CSV file

htkwan — Tue, 15 Mar 2016 14:28:35 GMT

Hello,
Thanks.