How to update a lookup table files automatically ?

[nouhab]

Hi All,

I have a Powershell script that generates a daily CSV file. I put manually that CSV file as Lookup table files using "settings> lookups> Lookup table files> add new" to use it for my splunk search "|lookup file.csv number as From OUTPUT User as FromUser ".

My question is, how do I get the lookup table to update automatically whenever the CSV file is updated in the specific local file ?

Thanks in advance,
Nouha

[woodcock]

There is no REST endpoint to do this but the Lookup Editor app (which is included in Enterprise Security) provides one that you can leverage, too. Just install the app and dig around and do what it does:
https://splunkbase.splunk.com/app/1724/

[nouhab]

Thank you woodcock for your answer, but even with the Lookup File Editor application it is not possible to update the file automatically.
I have to upload the new file manually every time.

[woodcock]

If you open up the guts, you will see how to do it programmatically with the REST endpoints. You still have to write some (very easy) software.