Can you add a lookup table without a restart?

[mattcg]

Is there a way to manually specify a lookup table for a search using a csv located on the server without making conf changes that require a splunk restart?

The lookup would be used for a single manual search so it can be specified at search time.

[stephanbuys]

Use the Lookup command http://www.splunk.com/base/Documentation/4.1.4/SearchReference/Lookup and define the lookup table using the Manager (Manager -> Lookups -> Lookup table files)

[sophy · Accepted solution]

You do not have to restart Splunk if you define/configure your lookups through Manager > Lookups in the UI. Here's an example:

http://www.splunk.com/base/Documentation/latest/User/CreateAndConfigureFieldLookups

[khourihan_splun]

here's in example: http://answers.splunk.com/answers/58338/how-to-load-a-csv-file-into-splunk-change-the-csv-file-dynam...

so you'd create a lookups directory in an app and plunk them in there:

i.e. ~/etc/apps/sample_app/lookups

[mattcg]

Can't seem to find information on adding a lookup table via the CLI. Can you provide a link or example? I assume you're not talking about changing config files in CLI, as those require a restart.

[araitz]

You can just as easily make changes via the CLI. Since search is a separate process, it refreshes search-time configurations on initialization.