I have a lookup created from a CSV file.
i put in entries
When i do a search, i can find these values.
now ,next day i add a new entry 6 and save the csv file.
i dont see the search showing 6, it only shows 1-5
can you help me fix this, it seems the lookup file updates are not being honored...
you can place your lookup file in the below directory and can access from search query
search query :
Found the answer.
i had the same lookup name file from 2 different locations . i was updating one of the file and so that was considered by splunk as not primary , so it was not showing.
i delete the duplicate entry and now i can see the new entry...