Splunk Dev

Splunk CSV Lookup

ChristophRichte
Loves-to-Learn

Hello Guys,

I've run into a problem. I created a dashboard where you can edit and delete lookup entries by user input. The problem is that when the user deletes the last entry of the lookup, the header of the CSV disappears and when a Saved Search is run, it cannot find the defined fields.

Does anyone have a solution to keep the header fields even if the last line is deleted, apart from creating a KV store?

With friendly greetings
Christoph

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...