Dashboards & Visualizations

Dynamic lookup file

MrJohn230
Path Finder

I have a file that's updated every 5 minutes, it's populated my capturing a value in a URL using python code. (the value is "OK" or "bad"). I want to use the new file (that created every 5 minutes) in a splunk classic dashboard. I'm using the splunk cloud enterprise, and I'm not sure how to go about automating this process. 

Is there a way to update/replace a file in the lookup table files? Or some other way I can go about adding in the new file after every refresh to the dashboard?

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MrJohn230 ,

if you have a file so frequently updated, in my opinion, the best solution is to load every version of the file in an index and use as events, in this way, taking only the last version of the data, you'll always have updated data.

Ciao.

Giuseppe

PickleRick
SplunkTrust
SplunkTrust

Either Splunk Cloud or Splunk Enterprise. There is no such thing as Splunk Cloud Enterprise.

Also why do you want it to be a lookup? You can easily just use events in your table.

MrJohn230
Path Finder

@PickleRick  I'm using splunk enterprise. I wasn't sure of the best approach here, sounds like I can use events, not sure how I can go about doing this but I'll do more research. 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...