Updating managed lookup via api in cloud

[FuzzySteve]

Hello Community!

We have a particular set of searches that rely on a lookup against a managed lookup (adhock).  The lookup is 2 columns, Username and Status.  Currently, we update this list manually every day by going in to content management, searching for the file, and then adding and deleting entries.

This was ok to start, but now the list is getting unmanageable.

What we would like to do, ideally, is take a local CSV and upload it over top of the one that exists via a PoweShell script that will be run on a local machine.  If that is not an option, I would be willing to have a script that creates a search to update the managed lookup that can be copied and pasted into a search.

looking for suggestions and ideas.  Thanks in advance.

[aniket_92]

its working. thanks

import json
import requests
from requests.auth import HTTPBasicAuth

# Disable insecure request warnings if you use self-signed certificates
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# 1. Correct Endpoint Path Mapping
# Splunk converts the 'post_xxx' python method into a POST route at '/data/lookup_edit/xxx'
url = "https://localhost:8089/servicesNS/nobody/lookup_editor/data/lookup_edit/lookup_contents"

lookup_matrix = [
    ["id", "name"],   # Header row
    ["104", "abc"],
    ["105", "xyz"]
]

# 2. Re-structured to match the exact method signature variables of post_lookup_contents
payload = {
    "lookup_file": "test.csv",
    "contents": json.dumps(lookup_matrix), # Must be a serialized JSON string array
    "namespace": "lookup_editor",                 # Destination app context (use 'search' or 'lookup_editor')
    "owner": "nobody",                     # Mapped to global/nobody context
    "backup": "false",                     # Explicit string boolean flag required by controller
    "isNew": "false"                       # Explicit flag required to prevent 'already exists' or missing path issues
}

resp = requests.post(
    url,
    data=payload,   # Must be sent as form data (x-www-form-urlencoded), NOT raw JSON payload
    auth=HTTPBasicAuth("admin", "Test@12345"),
    verify=False
)

print("Status Code:", resp.status_code)
print("Response:", resp.text)

[FuzzySteve]

We do not use the lookup editor app but I will investigate if we can have it added to our instance.
your curl example looks similar to some other posts I've seen here. My concern is that it's targeted at a local host.  Would it work with a cloud instance?

[mcmaster]

You may need to put in a support request to have your IP address added to the allowlist for API access to your cloud instance, but otherwise yes it should work with a cloud instance.

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2201/RESTTUT/RESTandCloud

[mcmaster]

Hey @FuzzySteve ,

Unfortunately there's no built-in way to do what you're trying to do. You could script the conversion of a .csv file into SPL to generate a lookup, or if you have the Lookup Editor app installed (https://splunkbase.splunk.com/app/1724/) it provides a REST API endpoint that you might be able to use to update the lookup. Here's an example:

curl -k -u admin:password -X POST -d namespace=search -d lookup_file=users.csv -d contents='[["username", "email"], ["admin", "[email protected]"]]' https://localhost:8089/servicesNS/nobody/lookup_editor/data/lookup_edit/lookup_contents

The contents value is just a JSON array of arrays - the outer array makes up the "rows" of the CSV file and the inner arrays make up the "columns".

[aniket_92]

@mcmaster hello,

I am getting path not found. Could you please help me here.

Thanks