Getwatchlist Add-on for Splunk Enterprise: How to run getwatchlist command to the local file?

[mcbradfords]

Our search head does not have internet access. I have downloaded bigblacklist.tar.gz and placed in tmp on search head. I want to run | getwatchlist to the local file, but have not had any success? Any help/ideas?

[dshpritz]

Hello mcbradfords,

This isn't something that getwatchlist does, mostly because it really isn't something I have found was needed, outside of Splunk's capabilities. My suggestion here would be to create a lookup which points to a local file, and then update the file that the lookup is pointing to. Failing that, you would have to have some kind of http server that is serving up the file, but if you are local system access already, I would go with the lookup route. You may also want to look at the inputcsv command. Hope this helps.

Dave