Getting Data In
Highlighted

Update a lookup file via REST

Ultra Champion

I want to be able to update an existing csv lookup file (that resides within the lookups directory of a custom app on a searchhead) by uploading the updated file from the local machine(via a custom widget that uses the REST api)

I see there is a REST endpoint similar to this but requires the the lookup file to be published to a staging area on the Splunk server and doesn't allow you to target the destination app.

Tags (1)
Highlighted

Re: Update a lookup file via REST

Legend

There's another REST endpoint that seems to be addressing this exact thing: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTknowledge#POST_data.2Ftransforms.2Flo...

Highlighted

Re: Update a lookup file via REST

Ultra Champion

I don't see how this endpoint can be used to update an existing csv file, as in the contents of the existing lookup file.
The endpoint you mentioned is just for updating the lookup definition.

0 Karma
Highlighted

Re: Update a lookup file via REST

Legend

Hm, true. Sorry!

0 Karma
Highlighted

Re: Update a lookup file via REST

Influencer

You could add a custom REST endpoint to Splunk that handles the file upload and updates the lookup CSV file.

Highlighted

Re: Update a lookup file via REST

Ultra Champion

Cheers Z... I think that will be the approach.

0 Karma
Highlighted

Re: Update a lookup file via REST

Influencer

Did you ever create this functionality? Can you share?

0 Karma