How can we administer the lookups better?

[ddrillic]

We would like to administer the lookups in bulk, meaning, to upload them in bulk, to change permissions in bulk, etc. We also would like to administer the lookups at the content level - change field names and such.

How can we do that?

[woodcock]

You can use the Lookup file editor app OR
You can deploy apps inside of apps from a Deployer to Search Heads in a Search Head Cluster.
You can deploy apps inside of apps from a Deployment Server to Search Heads and/or Indexers.
You can deploy lookup files with other non-Splunk tools like Puppet, Chef, SCCM, Tanium, etc.

[somesoni2]

See this (REST API endpoint for managing lookups, see one below this as well for updating individual lookups). You should be able to write a script to do bulk operations using this.

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTknowledge#data.2Flookup-table-files

[ddrillic]

Interesting thing. Is there any app with a nice UI for our users to do this type of work?

[gjanders]

Like the lookup file editor?

[ddrillic]

That would be cheerful ; -) I'll download it - great.

[lakshman239]

You could also consider moving all lookups to KVstore where you can do similar actions quickly using searches.

[ddrillic]

An interesting thing @lakshman239.