I've built a Splunk App with lookups. On app upload the lookup definitions are created but the CSV are not.
App Folder Structure
my_app
├── bin
│ ├── README
│ └── app.manifest
├── default
│ ├── app.conf
│ ├── data
│ │ └── ui
│ │ ├── nav
│ │ │ └── default.xml
│ │ └── views
│ │ └── README
│ └── transforms.conf
├── lookups
│ ├── test_falsePositive.csv
│ └── test_metadata.csv
└── metadata
└── default.meta
default.meta
[]
access = read : [ * ], write : [ admin, mgmt ]
### LOOKUPS
[lookups]
export = system
[transforms]
export = system
transforms.conf
[test_falsePositives]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_falsePositive.csv
[test_metadata]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_metadata.csv
