Do not overwrite CSV-Lookup files with upgrade of app?

[klowk]

Hi,

we have build a new app internally.

We use different CSV-Files to save relevant data. Is there any possibility to ignore this files during packaging the app on development system or is there a flag we can set on production system that these csv files are not overwritten during update?

Because the csv files have different content on development and production system.

Thanks for your support

Kathrin

[gjanders]

are you attempting to Preserve lookup files across app upgrades ?

[klowk]

it is only an option in search head cluster am i wrong?

[gcusello]

Hi @klowk,

Ciao and Next Time!

Giuseppe

P.S.: Karma Points are appreciated.

[gjanders]

Yes sorry,  this won't work for a standalone node

[gcusello]

Hi @klowk,

where did you stored these csv files, in $SPLUNK_HOME/etc/apps/your_app or in $SPLUNK_HOME/var/run/splunk/csv ?

if the first, there's the risk to overwriteing files.

I the second no problems.

Only one additional question for my curiosity: why do you use csv instead a summary index or a lookup/kv-store?

Ciao.

Giuseppe

[klowk]

Hi Giuseppe,

at the moment we store the csv-files in App context ($SPLUNK_HOME/etc/apps/your_app).

Yes may be it is better to store them  in $SPLUNK_HOME/var/run/splunk/csv. Then we can still have the configuration and permissions on csv lookup file in app context correct?

The other option is to convert these files into kv-stores, the files are very smal so we only want to use csv files in our first version.

kind regards

Kathrin

[gcusello · Accepted solution]

Hi @klowk,

in few words, you stored some information in lookups base on csv.

in this case, if you have a Search Head Cluster, the only way is to update apps using the preserve lookups option (https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges#Pres...).

If instead you have a Stand Alone Search Head or an All-in-one server, you have to preserve them manually.

Ciao.

Giuseppe