Getting Data In

how do I get the lookup table to update automatically whenever the CSV file is updated in the specific local file ?

chaitanya1996
Engager

Hello,
I have a csv file generated by script daily at $SplunkHome\etc\apps\bin\'fuel_stations.csv'. I add manually that CSV file as Lookup table files using "settings> lookups> Lookup table files> add new" to use it for my splunk search |inputlookup fuel_station.csv.

Now I want to automate to update lookup file whenever this csv file in above path is updated.
How do I get the lookup table to update automatically whenever the CSV file is updated in the specific local file ?
splunk v.6.6.3
Thanks

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi chaitanya1996,

Easiest solution for this is to change the script to output the csv into the correct directory $SPLUNK_HOME\etc\apps\<yourApp>\lookups\fuel_stations.csv this will use the updated lookup file immediately when using | inputlookup afterwards.

This will only work if the script is not running in a Search Head Cluster; if you plan to run it in a search head cluster you can use this app https://splunkbase.splunk.com/app/4649/#/overview

Hope this helps ...

cheers, MuS

0 Karma

chaitanya1996
Engager

Hi @MuS ,

I have fuel_stations.csv file at indexer in Search Head Cluster. I want to update the lookup in search head and do |inputlookup across all search heads.

can you suggest to get this in any possible way.
And can you please elaborate it whether we can use the app you suggested to get this done.

Thanks,
Chaitanya

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi chaitanya1996,

Lookup files should be created, stored and use on search heads. Just read the details of the app and you will get all details needed to learn how you can update the lookup file in a search head cluster.

cheers, MuS

0 Karma

prachisaxena
Explorer

Hi,

i would suggest monitoring this file $SplunkHome\etc\apps\bin\'fuel_stations.csv' using the splunk file monitoring. So, that the data in splunk is indexed everytime you update the file.

Then you can schedule a search to this data to lookup csv file using outputlookup command.
index =
| table field1, field2
|outputlookup fuel_station.csv append=(true|false)

0 Karma

chaitanya1996
Engager

Hi @prachisaxena,

When we monitor the csv file, if we change the value of field2 in row 2 from 5 to 4.. it gets into splunk.
But if we again change the field2 in row 2 from 4 to 5 , it doesn't get into splunk and iam not able to get the latest updated one due to this.

Thanks,
Chaitanya

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...