topic Re: How can I upload & Replace lookup files on a weekly basis? in Splunk Search

How can I upload & Replace lookup files on a weekly basis?

srw46 — Mon, 11 Jul 2011 11:04:13 GMT

Hi guys,

I'm using a lookup table that is subject to the occasionally change. I've been trying to setup a weekly job to replace the existing file with a newer version but the batch job fails on 'access denied' because the file is apparently in use (by Splunk).

I'm trying to drop the csv file right on top of the other one and overwrite in \etc\apps\search\lookups

Is there anyway I can get around this or another angle I should take? Many thanks,

Re: How can I upload & Replace lookup files on a weekly basis?

dwaddle — Mon, 11 Jul 2011 14:43:46 GMT

I've not known Splunk to lock lookup files, even while in use during a search. Is this on a Unix or a Windows indexer?

Best practice in this situation would probably be a multiple-setup process

Upload new lookup under a temporary name
Rename existing lookup to a different name
Rename new lookup to the "correct" name
Delete the old lookup

These steps make your change more likely to be atomic and less likely to impact searches that are running during your update or that start while your update is happening.

Re: How can I upload & Replace lookup files on a weekly basis?

srw46 — Tue, 12 Jul 2011 07:14:16 GMT

Thanks I'll try these steps and report back. I assumed that if the file was locked then I wouldn't be able to rename either. It's a Windows server.

I was fairly certain credentials were in place but I'll investigate that again first if you feel Splunk shouldn't be locking the file.