How can I upload & Replace lookup files on a weekly basis?

[srw46]

Hi guys,

I'm using a lookup table that is subject to the occasionally change. I've been trying to setup a weekly job to replace the existing file with a newer version but the batch job fails on 'access denied' because the file is apparently in use (by Splunk).

I'm trying to drop the csv file right on top of the other one and overwrite in \etc\apps\search\lookups

Is there anyway I can get around this or another angle I should take? Many thanks,

[dwaddle · Accepted solution]

I've not known Splunk to lock lookup files, even while in use during a search. Is this on a Unix or a Windows indexer?

Best practice in this situation would probably be a multiple-setup process

1. Upload new lookup under a temporary name
2. Rename existing lookup to a different name
3. Rename new lookup to the "correct" name
4. Delete the old lookup

These steps make your change more likely to be atomic and less likely to impact searches that are running during your update or that start while your update is happening.

[srw46 · Accepted solution]

Thanks I'll try these steps and report back. I assumed that if the file was locked then I wouldn't be able to rename either. It's a Windows server.

I was fairly certain credentials were in place but I'll investigate that again first if you feel Splunk shouldn't be locking the file.

[dwaddle · Accepted solution]

I've not known Splunk to lock lookup files, even while in use during a search. Is this on a Unix or a Windows indexer?

Best practice in this situation would probably be a multiple-setup process

1. Upload new lookup under a temporary name
2. Rename existing lookup to a different name
3. Rename new lookup to the "correct" name
4. Delete the old lookup

These steps make your change more likely to be atomic and less likely to impact searches that are running during your update or that start while your update is happening.