Creating a REST endpoint to allow csv lookup files to be uploaded/updated?

[Aaron_Fogarty]

I would like to create a REST endpoint that will allow me to to automate the uploading and updating of a csv lookup file daily.
Is it possible to create such an endpoint and what would be the process to achieve this?

There is a similar question to this, but it has no accepted answer.

https://answers.splunk.com/answers/369789/how-to-create-or-update-kv-store-via-rest-endpoint.html

Thank you in advance.

[somesoni2]

I'm guessing you updated the URI form .../servicesNS/admin/search/.... to .../servicesNS/-/search/.. to create it in search app. For the other error, could you check if the Splunk user (user under which Splunk service is running has appropriate permissions on the lookup table file you're trying to upload?

[Aaron_Fogarty]

Hey Somesoni2,

I posted an answer below, It wont let me post it here for some reason.

[Aaron_Fogarty]

Yeah somesoni2 thats exactly what I did, Ill post for others to see

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 
Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv

As for the 'Data could not be written:' error, I am running the command line as the Administrator. I also chaged the TestLookup.csv file properties>>security permissions of all the Group and user names to allow full control. Is this what you meant?

I then restarted Splunk and re-ran the following command. I still got the 'Data could not be written' error

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv

[Aaron_Fogarty]

Yeah thats exactly what I did somesoni2, Ill post for others to see.

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x 

Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000

As for the 'Data could not be written' error. I am running the command line as the Administrator. I opened the TestLookup.csv file properties>>security and changed the permissions of all Group and user names to allow full control.

I then restarted Splunk and re-ran the following command, but I still got the same 'Data could not be written' error.

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv -x https://http.proxy.fmr.com:8000

[Aaron_Fogarty]

Yeah thats exactly what I did somesoni2, Ill post for others to see.

Was:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/admin/search/data/lookup-table-files -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 

Now:
curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 

For the 'Data could not be written' error. I am running as admin user.

Under Properties>>Security I changed the permissions to all group and user names to full control for the TestLookup.csv file.

I restarted Splunk and re-ran the following command but I still got the same error

curl -k -u admin:splunk https://10.10.10.65:8089/servicesNS/nobody/search/data/lookup-table-files/ -d eai:data="C:/Program Files/Splunk/var/run/splunk/lookup_tmp/TestLookup.csv" -d name=TestLookup.csv 

[Aaron_Fogarty]

Hey somesoni2,

I will try this out and get back.

Thanks