topic Re: Multiple ways to access lookup transforms via REST, which should I use? in Splunk Search

Multiple ways to access lookup transforms via REST, which should I use?

LukeMurphey — Fri, 25 Aug 2017 18:48:55 GMT

There are multiple ways to access lookup transforms via REST, including:

data/transforms/lookups
configs/conf-transforms
properties/transforms/

Which one should I be using?

Re: Multiple ways to access lookup transforms via REST, which should I use?

LukeMurphey — Fri, 25 Aug 2017 18:50:29 GMT

Here is when you ought to use each endpoint:

If performing a write, use data/transforms/lookups
If performing a read and you need fields_list, use data/transforms/lookups
For everything else, use configs/conf-transforms

Generally, it is recommended that you avoid using data/transforms/lookups/ since this endpoint triggers some activity that can cause some unnecessary performance reduction and will generate a substantial number of log messages in the internal index.

If you need to access ACL information (i.e. namespace and owner) then you will need to use configs/conf-transforms since properties/transforms/ won't include it.

Re: Multiple ways to access lookup transforms via REST, which should I use?

hazekamp — Fri, 25 Aug 2017 19:25:49 GMT

We recommend the following GET arguments when pinpointing lookups using configs/conf-transforms. This is because transforms.conf houses all manner of properties.

getargs = {'output_mode': 'json', 'count': 0, 'search': 'filename=* OR collection=* OR external_type=*'}

Of course, if you're targeting a specific transform by name, this is not needed.