All Apps and Add-ons
Highlighted

How to update a lookup table files automatically ?

New Member

Hi All,

I have a Powershell script that generates a daily CSV file. I put manually that CSV file as Lookup table files using "settings> lookups> Lookup table files> add new" to use it for my splunk search "|lookup file.csv number as From OUTPUT User as FromUser ".

My question is, how do I get the lookup table to update automatically whenever the CSV file is updated in the specific local file ?

Thanks in advance,
Nouha

0 Karma
Highlighted

Re: How to update a lookup table files automatically ?

Esteemed Legend

There is no REST endpoint to do this but the Lookup Editor app (which is included in Enterprise Security) provides one that you can leverage, too. Just install the app and dig around and do what it does:
https://splunkbase.splunk.com/app/1724/

0 Karma
Highlighted

Re: How to update a lookup table files automatically ?

New Member

Thank you woodcock for your answer, but even with the Lookup File Editor application it is not possible to update the file automatically.
I have to upload the new file manually every time.

0 Karma
Highlighted

Re: How to update a lookup table files automatically ?

Esteemed Legend

If you open up the guts, you will see how to do it programmatically with the REST endpoints. You still have to write some (very easy) software.

0 Karma