Use Splunk SDK for Python to populate a lookup from a CSV file

[aflick2486]

I would like to populate the data inside of a lookup file from a .csv on a local computer. Is there a way to use the Splunk API or Splunk SDK for Python to to do this? Let me know if you need other information.

[starcher]

If you really want to maintain a lookup via the rest API the lookup has to be a kvstore lookup. CSV lookups cannot be directly modified. You can use python to read in the csv file but use the REST API to control a kvstore lookup.

Similar to this:
https://github.com/georgestarcher/Splunk-ESIntel-KVStore

[FritzWittwer · Accepted solution]

You have to get the .csv file to the search head first, see this question and this question. If you can't put the file to the search head, I would try to use the rest api to create a search with ... | outpulookup xxx, this might work for a small file, or have a universal forwarder which indexes the local file, and then a search which reads the index and writes the .csv file with an outputlookup

[lfedak_splunk]

Hey @aflick2486, Not sure if this helps, but here's a post on scripting a lookup with Python and the code has "import csv": https://answers.splunk.com/answers/145561/how-to-script-a-lookup-in-python.html