Importing lookup table to Splunk lookup table file editor

[waJesu]

Is it possible to import an already created lookup table into the Splunk lookup file editor without having to create a new one in the editor? If it is possible, how do I do it?

[gcusello]

Hi @waJesu,

you have two choices:

• create a new lookup clicking on "Create a new Lookup" from the Lookup Editor app and importing and saving the csv file,
• import the lookup from the Settings menu: [Settings > Lookups > Lookup Table Files > New Lookup Table Files].

In both cases, remember to create the Lookup Definition, because it isn't automatic.

Ciao.

Giuseppe

[waJesu]

Hi Giuseppe

I already have a lookup table created. My question is if it is possible to import that into the Splunk Lookup file editor and not create a new one from there.

[gcusello]

Hi @waJesu ,

yes, in the right top of the Splunk Editor dashboad there's the Import button.

Ciao.

Giuseppe

[waJesu]

I am not sure why I don't have the import button on my instance.

[gcusello]

Hi @waJesu,

which version have you?

I have 3.6.0, it isn't the last one, and I have

gcusello_0-1698414210366.png

Ciao.

Giuseppe