Splunk Search
Highlighted

How can we administer the lookups better?

Ultra Champion

We would like to administer the lookups in bulk, meaning, to upload them in bulk, to change permissions in bulk, etc. We also would like to administer the lookups at the content level - change field names and such.

How can we do that?

0 Karma
Highlighted

Re: How can we administer the lookups better?

SplunkTrust
SplunkTrust

See this (REST API endpoint for managing lookups, see one below this as well for updating individual lookups). You should be able to write a script to do bulk operations using this.

https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTknowledge#data.2Flookup-table-files

Highlighted

Re: How can we administer the lookups better?

Ultra Champion

Interesting thing. Is there any app with a nice UI for our users to do this type of work?

0 Karma
Highlighted

Re: How can we administer the lookups better?

SplunkTrust
SplunkTrust
Highlighted

Re: How can we administer the lookups better?

Ultra Champion

That would be cheerful ; -) I'll download it - great.

0 Karma
Highlighted

Re: How can we administer the lookups better?

SplunkTrust
SplunkTrust

You could also consider moving all lookups to KVstore where you can do similar actions quickly using searches.

Highlighted

Re: How can we administer the lookups better?

Ultra Champion

An interesting thing @lakshman239.

0 Karma
Highlighted

Re: How can we administer the lookups better?

Esteemed Legend

You can use the Lookup file editor app OR
You can deploy apps inside of apps from a Deployer to Search Heads in a Search Head Cluster.
You can deploy apps inside of apps from a Deployment Server to Search Heads and/or Indexers.
You can deploy lookup files with other non-Splunk tools like Puppet, Chef, SCCM, Tanium, etc.

0 Karma