What is the recommended way to upload / update an existing lookup file through rest api.
I tried using lookup endpoints but it doesnt seem to be working.
In short, I have a lookup file, abc.csv in search application under my ownership. I now need to overwrite with an updated file. How can we do this using rest api?
Well... this is tricky because the endpoints for lookup table files require you to first upload the file to the server using another channel. Then with API you point Splunk to such file and it copies the file into its own directory.
You can't directly upload a lookup file into Splunk.
If I remember correctly, the lookup editor app had API which allowed for overwriting lookups directly but they might not be documented.