Edit a lookup file through the REST API

[rolyrolex]

Hello !!

I am new to using splunk and would like to know if it is possible to edit a lookup file via Splunk REST API or lookup editor API ? 

Thank y'all

[PickleRick]

In general, it's not possible to update parts of a file-based lookup. You can overwrite whole lookup file (either by REST API or outputlookup command). You can of course edit the file directly on the server(s) but it will also effectively work as complete replacement of old contents when splunk reloads the lookup file.

[richgalloway]

There is no API for updating parts of a lookup file.  You must replace the whole thing.  See the REST Reference Manual at https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTknowledge#data.2Flookup-table-files.2...

[rolyrolex]

Thank you !!

Can i use this with splunk cloud  ? or how do i put a file in the upload staging area ?

[rolyrolex]

Thank you all for your responses.

I think I should fully explain what I would like to do to find out if this is possible.

we have lookup file configurations in a Google Sheet, currently we are updating these configurations manually in the lookup files in splunk.

Now we want to automate the creation or modification directly from the google sheet.

So I would like to know if this is possible with splunk tools.

Thank you

[PickleRick]

As we wrote - your process has to rewrite contents of the lookup completely.

As a matter of fact, I have a similar situation - my users supply data in .csv file put on a network share. I read this file as a delimited source file and push the events into a small auxiliary index. Then I do a scheduled report which reads the latest occurences of the events and ends with | outputlookup in order to write the results to a lookup. This way whenever my users put a new file into a well-known location, they get an updated lookup within few minutes.

EDIT: As a word of explanation - I could have done that perfectly well using external scripts and calling appropriate REST endpoint to refresh contents of the lookup file but in this case the point was that I wanted to do it entirely with built-in splunk functionality - without any external tools.