Splunk Search

Can you add a lookup table without a restart?

mattcg
Explorer

Is there a way to manually specify a lookup table for a search using a csv located on the server without making conf changes that require a splunk restart?

The lookup would be used for a single manual search so it can be specified at search time.

Tags (2)
1 Solution

sophy
Splunk Employee
Splunk Employee

You do not have to restart Splunk if you define/configure your lookups through Manager > Lookups in the UI. Here's an example:

http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups

View solution in original post

stephanbuys
Path Finder

Use the Lookup command http://www.splunk.com/base/Documentation/4.1.4/SearchReference/Lookup and define the lookup table using the Manager (Manager -> Lookups -> Lookup table files)

sophy
Splunk Employee
Splunk Employee

You do not have to restart Splunk if you define/configure your lookups through Manager > Lookups in the UI. Here's an example:

http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups

khourihan_splun
Splunk Employee
Splunk Employee

here's in example: http://answers.splunk.com/answers/58338/how-to-load-a-csv-file-into-splunk-change-the-csv-file-dynam...

so you'd create a lookups directory in an app and plunk them in there:

i.e. ~/etc/apps/sample_app/lookups

0 Karma

mattcg
Explorer

Can't seem to find information on adding a lookup table via the CLI. Can you provide a link or example? I assume you're not talking about changing config files in CLI, as those require a restart.

0 Karma

araitz
Splunk Employee
Splunk Employee

You can just as easily make changes via the CLI. Since search is a separate process, it refreshes search-time configurations on initialization.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...