Splunk Search

How do you manage modified lookup files that ship with an app?

john_dagostino
Path Finder

Let's say an app ships with one or more default CSV lookup tables. You want to add additional data to these lookups so you modify the CSV (manual edit, not through any search function). The next app update will then overwrite the modified CSV file.

What would be the best practice regarding modifying lookup files that ship with an app? Clone the file and then modify that? Move it to a default app and then update the transforms.conf?

0 Karma

p_gurav
Champion

Hi,

The only safer way here is to take backup of lookup before you update application. And after update you can replace that with your lookup.

0 Karma