Splunk Search
Highlighted

Can you add a lookup table without a restart?

Explorer

Is there a way to manually specify a lookup table for a search using a csv located on the server without making conf changes that require a splunk restart?

The lookup would be used for a single manual search so it can be specified at search time.

Tags (2)
Highlighted

Re: Can you add a lookup table without a restart?

Splunk Employee
Splunk Employee

You do not have to restart Splunk if you define/configure your lookups through Manager > Lookups in the UI. Here's an example:

http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups

View solution in original post

Highlighted

Re: Can you add a lookup table without a restart?

Splunk Employee
Splunk Employee

You can just as easily make changes via the CLI. Since search is a separate process, it refreshes search-time configurations on initialization.

0 Karma
Highlighted

Re: Can you add a lookup table without a restart?

Explorer

Can't seem to find information on adding a lookup table via the CLI. Can you provide a link or example? I assume you're not talking about changing config files in CLI, as those require a restart.

0 Karma
Highlighted

Re: Can you add a lookup table without a restart?

Splunk Employee
Splunk Employee

here's in example: http://answers.splunk.com/answers/58338/how-to-load-a-csv-file-into-splunk-change-the-csv-file-dynam...

so you'd create a lookups directory in an app and plunk them in there:

i.e. ~/etc/apps/sample_app/lookups

0 Karma
Highlighted

Re: Can you add a lookup table without a restart?

Path Finder

Use the Lookup command http://www.splunk.com/base/Documentation/4.1.4/SearchReference/Lookup and define the lookup table using the Manager (Manager -> Lookups -> Lookup table files)