updating lookup file

[hmrabet2]

Is there a way up populate contents of a lookupfile such such as srcip and destip obtained from another source currently not feeding in to splunk? im wanting to do this from the splunk search box or dashboard input box?

[nickhills]

I think what your asking is:

Can i configure a lookup file in
Splunk, and then update the lookup
file from an external source/process?

In which case, - yes you can. The lookup file is read each time the lookup is invoked, so you can update it outside of splunk, and it will read the latest file every time.

(Distributed environments are a bit more complicated, so it may take a few seconds for all the peers to get the latest copy)

[somesoni2]

How and in what format you're getting your data (srcip and destip) form your other source? If data is not in your Splunk instance, you'd have to find a way to get them in. Once they're in, you could use a Splunk which will manipulate and update your lookup data and use outputlookup command to overwrite/update it.

[Yunagi]

Check out the outputlookup command.

[harsmarvania57]

Hi,

You can do external lookup in splunk using custom scripts, please refer documentation
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/Aboutlookupsandfieldactions
http://docs.splunk.com/Documentation/Splunk/7.0.1/Knowledge/DefineanexternallookupinSplunkWeb