Hey guys,
Is there any way how splunk get this lookup update itself or do we need to manually feed it? if yes what is the way around. Thanks
You need to provide more details. What app, what version of splunk, why are you updating it, how do you want to update it...?
Thanks,
I am using Splunk Security Essential App here, the rule comes as part of this app named: Basic TOR Traffic Detection
inputlookup UC_tor_traffic
| search app=tor src_ip=*
| table _time src_ip src_port dest_ip dest_port bytes app
When i checked the content of lookup: UC_tor_traffic, it shows the old data having dates of 2017, may be the dummy one. Curious about how to update this table and what is the way around.
Thanks in advance