Getting Data In
Highlighted

Use Splunk SDK for Python to populate a lookup from a CSV file

Explorer

I would like to populate the data inside of a lookup file from a .csv on a local computer. Is there a way to use the Splunk API or Splunk SDK for Python to to do this? Let me know if you need other information.

0 Karma
Highlighted

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

Splunk Employee
Splunk Employee

Hey @aflick2486, Not sure if this helps, but here's a post on scripting a lookup with Python and the code has "import csv": https://answers.splunk.com/answers/145561/how-to-script-a-lookup-in-python.html

0 Karma
Highlighted

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

Contributor

You have to get the .csv file to the search head first, see this question and this question. If you can't put the file to the search head, I would try to use the rest api to create a search with ... | outpulookup xxx, this might work for a small file, or have a universal forwarder which indexes the local file, and then a search which reads the index and writes the .csv file with an outputlookup

View solution in original post

Highlighted

Re: Use Splunk SDK for Python to populate a lookup from a CSV file

SplunkTrust
SplunkTrust

If you really want to maintain a lookup via the rest API the lookup has to be a kvstore lookup. CSV lookups cannot be directly modified. You can use python to read in the csv file but use the REST API to control a kvstore lookup.

Similar to this:
https://github.com/georgestarcher/Splunk-ESIntel-KVStore

0 Karma