Update @csv file on a Splunk share by allowed users

[BSilva]

We have a csv file that was uploaded into Splunk, with some interesting data for some Use-Cases.

We would like to know if there is any way of making changes to the csv file and the changes be automatically reflected into Splunk Search head Servers, without having to upload the updated file every time a new change is made to it.

Thanks, in advance, for your time.

Kind regards.

[gcusello]

Hi @BSilva ,

if you're speaking of manual updates on the csv file, you could manually update the csv in the Splunk Lookup Editor App instead than in Excel.

If you have automatic updates on the file, you could create an input monitor that monitors the folder where the csv file is stored and automatically reads every change.

Ciao.

Giuseppe

[PickleRick]

I had it done exactly like this - users had a share where they would upload a current version of the csv file. That file would be picked up by the monitor input and sent as events to the indexers. Then a scheduled search on the SH tier would search for the most recent events and do outputlookup.