I lookup definition just points to a CSV on the file system. If that CSV is broken in some way and 'replaced' on the file system, then the new one will be used. It may required the Splunk environment to be refreshed, there may be a caching issue there, but if you are unable to refresh the environment easily, then simply upload the new CSV and change the associated filename in the lookup definition to use the new CSV. In a clustered environment the lookup will need to be propagated between the search heads during replication.
