Splunk Dev

When uploading an app CSV lookups do not appear in Splunk Cloud

bpal
Loves-to-Learn

I've built a Splunk App with lookups.  On app upload the lookup definitions are created but the CSV are not.

App Folder Structure

 

my_app
├── bin
│   ├── README
│   └── app.manifest
├── default
│   ├── app.conf
│   ├── data
│   │   └── ui
│   │   ├── nav
│   │   │   └── default.xml
│   │   └── views
│   │   └── README
│   └── transforms.conf
├── lookups
│   ├── test_falsePositive.csv
│   └── test_metadata.csv
└── metadata
└── default.meta

 

 

default.meta

 

[]
access = read : [ * ], write : [ admin, mgmt ]

### LOOKUPS

[lookups]
export = system

[transforms]
export = system

 

 

transforms.conf

 

[test_falsePositives]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_falsePositive.csv

[test_metadata]
CAN_OPTIMIZE = 1
CLEAN_KEYS = 1
DEPTH_LIMIT = 1000
KEEP_EMPTY_VALS = 0
LOOKAHEAD = 4096
MATCH_LIMIT = 100000
MV_ADD = 0
SOURCE_KEY = _raw
WRITE_META = 0
batch_index_query = 0
case_sensitive_match = 0
disabled = 0
filename = test_metadata.csv

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...