Splunk Dev

When uploading an app CSV lookups do not appear in Splunk Cloud

bpal
Loves-to-Learn

I've built a Splunk App with lookups.  On app upload the lookup definitions are created but the CSV are not.

App Folder Structure

 

my_app
├── bin
│   ├── README
│   └── app.manifest
├── default
│   ├── app.conf
│   ├── data
│   │   └── ui
│   │   ├── nav
│   │   │   └── default.xml
│   │   └── views
│   │   └── README
│   └── transforms.conf
├── lookups
│   ├── test_falsePositive.csv
│   └── test_metadata.csv
└── metadata
└── default.meta

 

 

default.meta

 

[]
access = read : [ * ], write : [ admin, mgmt ]

### LOOKUPS

[lookups]
export = system

[transforms]
export = system

 

 

transforms.conf

 

[test_falsePositives]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_falsePositive.csv

[test_metadata]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_metadata.csv

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...