How do I locate KVstore & scripted based look ups?

[SamHTexas]

Under lookups I see a few .csv based & few look up definitions. So where are the KVstore based or scripted based lookups located or are they created manually?

[gcusello]

Hi @SamHTexas,

all the lookups (file, kv-store, script, etc...) are located on the Search Heads in:

• the lookups folder of each app,
• the $SPLUNK_HOME/etc/system/default folder,
• the $SPLUNK_HOME/etc/system/local folder,
• in the user folders ($SPLUNK_HOME/etc/user/<user_name>/<app>).

if you see few lookups, use a different filter because by default lookups are filtered by app in the dashboard.

Ciao and happy splunking.

Giuseppe

[SamHTexas]

Grazie, I see my .csv files under the definitions & located some scripts also there via a SH GUI. How about KSstores? Do they have to be edited via CLI?