What is the path for input files

[randymw59]

I am new to Splunk...I have been given a query that uses an input file. I know the name of the input file, but how can I find the full pathname of where that file resides?

[somesoni2]

The file that you're looking is lookup table path. Use following query to get the full path

| rest /services/data/lookup-table-files | rename eai:* as * | table title acl.app data

The path will exist on the Search Head server. (/opt represent its the UNIX server)

[randymw59]

I've been able to identify the path as:

/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv

Can I edit the file in Splunk, or is it only possible to edit the file outside of Splunk in another editor program?

[esix_splunk]

You can edit this in splunk with the lookup editor app, which has to be downloaded an installed from apps.splunk.com. You can also edit locally and upload the new copy to the splunk server, but you have to have permissions assigned to be able to do this. The other option is editing it in the local file system.

[esix_splunk]

Depending on how the file is ingested, the source field will typically give you the full path of the file. If you can provide and example of what you are looking at, we can provide more concrete help...

[randymw59]

Here is the line in my query that reads the input file:
| inputlookup generic_ids_dcs.csv |

It doesn't list the entire pathname of the "generic_ids_dcs.csv" file, which is what I'm looking for.

Thanks....

[esix_splunk]

This a from a lookup file, not an indexed data source. You need to look in the configuration, under lookup files, and find the lookup file to find out where on disk this is located.

Alternatively, if you have shell access on the box, you can do a find command or 'splunk btool transforms list --debug' and look for the "generic_ids_dcs.csv" lookup and path definition.

[randymw59]

I don't know how to look in the configuration / lookup files...

[randymw59]

I did find this:

/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv

How can I map the full pathname? I'm not sure where the /opt resides.

[esix_splunk]

That is the full pathname, including the filename, of the lookup file. What do you mean by map?

You can add this path via an eval as

..currentsearch.. | eval mappedpath="/opt/splunk/etc/apps/search/lookups/generic_ids_dcs.csv"

And then do what you want to it..