Splunk Search

How can we administer the lookups better?

ddrillic
Ultra Champion

We would like to administer the lookups in bulk, meaning, to upload them in bulk, to change permissions in bulk, etc. We also would like to administer the lookups at the content level - change field names and such.

How can we do that?

0 Karma

woodcock
Esteemed Legend

You can use the Lookup file editor app OR
You can deploy apps inside of apps from a Deployer to Search Heads in a Search Head Cluster.
You can deploy apps inside of apps from a Deployment Server to Search Heads and/or Indexers.
You can deploy lookup files with other non-Splunk tools like Puppet, Chef, SCCM, Tanium, etc.

0 Karma

somesoni2
Revered Legend

See this (REST API endpoint for managing lookups, see one below this as well for updating individual lookups). You should be able to write a script to do bulk operations using this.

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTknowledge#data.2Flookup-table-files

ddrillic
Ultra Champion

Interesting thing. Is there any app with a nice UI for our users to do this type of work?

0 Karma

ddrillic
Ultra Champion

That would be cheerful ; -) I'll download it - great.

0 Karma

lakshman239
Influencer

You could also consider moving all lookups to KVstore where you can do similar actions quickly using searches.

ddrillic
Ultra Champion

An interesting thing @lakshman239.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...