Developing for Splunk Cloud Services

When uploading an app CSV lookups do not appear in Splunk Cloud

bpal
New Member

I've built a Splunk App with lookups.  On app upload the lookup definitions are created but the CSV are not.

App Folder Structure

 

my_app
├── bin
│   ├── README
│   └── app.manifest
├── default
│   ├── app.conf
│   ├── data
│   │   └── ui
│   │   ├── nav
│   │   │   └── default.xml
│   │   └── views
│   │   └── README
│   └── transforms.conf
├── lookups
│   ├── test_falsePositive.csv
│   └── test_metadata.csv
└── metadata
└── default.meta

 

 

default.meta

 

[]
access = read : [ * ], write : [ admin, mgmt ]

### LOOKUPS

[lookups]
export = system

[transforms]
export = system

 

 

transforms.conf

 

[test_falsePositives]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_falsePositive.csv

[test_metadata]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_metadata.csv

 

 

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!