Monitoring a file in $SPLUNKHOME/etc/apps/search/lookups

[mcm10285]

Does splunk read $SPLUNKHOME/etc/apps/search/lookups in a special manner? I placed a csv file in that directory of a search head to be monitored and it seems like it is not being indexed, or at least it's not searchable. Using it as an inputlookup works though. I want to monitor that file and use it in a form search, an inventory search.

Checked /var/log/splunk/splunkd.log, below is the only log found on the directory/path where the file is:

INFO TailingProcessor - Parsing configuration stanza: monitor:///splunksearches/SH/etc/apps/search/lookups/filename.csv

INFO TailingProcessor - Adding watch on path:///splunksearches/SH/etc/apps/search/lookups/filename.csv

[mcm10285]

somewhow this just worked..might have been a delayed indexing...

[lukejadamec]

Using tail for a one time file index routine is not the best way to go about it.
Try it from the commandline - see this post
splunk-base.splunk.com/answers/6922/how-to-ask-splunk-to-index-a-file-using-the-cli

[mcm10285]

tried the CLI and returned the message below

In handler 'monitor': Cannot create another input with the name "/splunksearches/SH/etc/apps/search/lookups/IP_Blocklist.csv", one already exists.

However, when I checked, the data is already indexed. Wonder how long it took.

Thanks for the suggestions anyway.

[martin_mueller]

Start your search with inputlookup, that'll give you the file in Splunk to continue your search:

| inputlookup file_name | search something or other

[mcm10285]

I don't. I just placed a file in the lookups folder and I want to index that.

Input lookup needs a search against it. I need to search on the file itself.

[martin_mueller]

Why would you index a lookup? If you want to start searches with that data, just use inputlookup.