All Apps and Add-ons

How to add lookup tables into Lookup File Editor with API?

fumeister
New Member

We are using Search Head Clustering. How can I add or delete new lookup tables through Lookup File Editor app?

Tags (1)
0 Karma

LukeMurphey
Champion

I see two options here. I tend to recommend the second option though since this is well documented. This does restrict you to using KV store collection though; CSV files are difficult to interact with via a REST API (I had to write my own in the Lookup Editor to make CSVs editable).

Here are the details:

Using the REST APIs in the Lookup Editor
The REST APIs for the Lookup Editor aren't well documented since I hadn't designed them for use outside of the app itself.

They can be used outside of the app if you want though. The REST handler is here: https://github.com/LukeMurphey/lookup-editor/blob/master/src/bin/lookup_editor_rest_handler.py. You can see an example of how the handler is used by looking at the Javascript here: https://github.com/LukeMurphey/lookup-editor/blob/master/src/appserver/static/js/views/LookupEditVie....

Use the Splunk KV store collection APIs
Alternatively, you can just use the KV store APIs included in Splunk. You can see them here: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...