Getting Data In

Use Splunk SDK for Python to populate a lookup from a CSV file

aflick2486
Explorer

I would like to populate the data inside of a lookup file from a .csv on a local computer. Is there a way to use the Splunk API or Splunk SDK for Python to to do this? Let me know if you need other information.

0 Karma
1 Solution

FritzWittwer_ol
Contributor

You have to get the .csv file to the search head first, see this question and this question. If you can't put the file to the search head, I would try to use the rest api to create a search with ... | outpulookup xxx, this might work for a small file, or have a universal forwarder which indexes the local file, and then a search which reads the index and writes the .csv file with an outputlookup

View solution in original post

starcher
Influencer

If you really want to maintain a lookup via the rest API the lookup has to be a kvstore lookup. CSV lookups cannot be directly modified. You can use python to read in the csv file but use the REST API to control a kvstore lookup.

Similar to this:
https://github.com/georgestarcher/Splunk-ESIntel-KVStore

0 Karma

FritzWittwer_ol
Contributor

You have to get the .csv file to the search head first, see this question and this question. If you can't put the file to the search head, I would try to use the rest api to create a search with ... | outpulookup xxx, this might work for a small file, or have a universal forwarder which indexes the local file, and then a search which reads the index and writes the .csv file with an outputlookup

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @aflick2486, Not sure if this helps, but here's a post on scripting a lookup with Python and the code has "import csv": https://answers.splunk.com/answers/145561/how-to-script-a-lookup-in-python.html

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...